diff --git a/google/cloud/securitycenter/v2/BUILD.bazel b/google/cloud/securitycenter/v2/BUILD.bazel
index f2afd33895..ea708652db 100644
--- a/google/cloud/securitycenter/v2/BUILD.bazel
+++ b/google/cloud/securitycenter/v2/BUILD.bazel
@@ -30,6 +30,7 @@ proto_library(
         "attack_path.proto",
         "backup_disaster_recovery.proto",
         "bigquery_export.proto",
+        "cloud_armor.proto",
         "cloud_dlp_data_profile.proto",
         "cloud_dlp_inspection.proto",
         "compliance.proto",
@@ -41,6 +42,7 @@ proto_library(
         "external_system.proto",
         "file.proto",
         "finding.proto",
+        "folder.proto",
         "group_membership.proto",
         "iam_binding.proto",
         "indicator.proto",
@@ -51,6 +53,7 @@ proto_library(
         "log_entry.proto",
         "mitre_attack.proto",
         "mute_config.proto",
+        "notebook.proto",
         "notification_config.proto",
         "notification_message.proto",
         "org_policy.proto",
@@ -75,6 +78,7 @@ proto_library(
         "//google/iam/v1:iam_policy_proto",
         "//google/iam/v1:policy_proto",
         "//google/longrunning:operations_proto",
+        "@com_google_protobuf//:duration_proto",
         "@com_google_protobuf//:empty_proto",
         "@com_google_protobuf//:field_mask_proto",
         "@com_google_protobuf//:struct_proto",
@@ -122,8 +126,8 @@ java_gapic_library(
     rest_numeric_enums = True,
     service_yaml = "securitycenter_v2.yaml",
     test_deps = [
-        "//google/iam/v1:iam_java_grpc",
         ":securitycenter_java_grpc",
+        "//google/iam/v1:iam_java_grpc",
     ],
     transport = "grpc+rest",
     deps = [
@@ -145,6 +149,7 @@ java_gapic_test(
 # Open Source Packages
 java_gapic_assembly_gradle_pkg(
     name = "google-cloud-securitycenter-v2-java",
+    include_samples = True,
     transport = "grpc+rest",
     deps = [
         ":securitycenter_java_gapic",
@@ -152,7 +157,6 @@ java_gapic_assembly_gradle_pkg(
         ":securitycenter_java_proto",
         ":securitycenter_proto",
     ],
-    include_samples = True,
 )
 
 ##############################################################################
@@ -194,6 +198,7 @@ go_gapic_library(
         "//google/longrunning:longrunning_go_proto",
         "@com_google_cloud_go_longrunning//:go_default_library",
         "@com_google_cloud_go_longrunning//autogen:go_default_library",
+        "@io_bazel_rules_go//proto/wkt:duration_go_proto",
         "@io_bazel_rules_go//proto/wkt:struct_go_proto",
     ],
 )
@@ -203,9 +208,9 @@ go_gapic_assembly_pkg(
     name = "gapi-cloud-securitycenter-v2-go",
     deps = [
         ":securitycenter_go_gapic",
-        ":securitycenter_go_gapic_srcjar-test.srcjar",
         ":securitycenter_go_gapic_srcjar-metadata.srcjar",
         ":securitycenter_go_gapic_srcjar-snippets.srcjar",
+        ":securitycenter_go_gapic_srcjar-test.srcjar",
         ":securitycenter_go_proto",
     ],
 )
@@ -271,8 +276,8 @@ php_gapic_library(
     name = "securitycenter_php_gapic",
     srcs = [":securitycenter_proto_with_info"],
     grpc_service_config = None,
-    rest_numeric_enums = True,
     migration_mode = "NEW_SURFACE_ONLY",
+    rest_numeric_enums = True,
     service_yaml = "securitycenter_v2.yaml",
     transport = "grpc+rest",
     deps = [
@@ -326,8 +331,8 @@ nodejs_gapic_assembly_pkg(
 # buildifier: disable=same-origin-load
 load(
     "@com_google_googleapis_imports//:imports.bzl",
-    "ruby_gapic_assembly_pkg",
     "ruby_cloud_gapic_library",
+    "ruby_gapic_assembly_pkg",
     "ruby_grpc_library",
     "ruby_proto_library",
 )
@@ -387,7 +392,6 @@ load(
 
 csharp_proto_library(
     name = "securitycenter_csharp_proto",
-    extra_opts = [],
     deps = [":securitycenter_proto"],
 )
 
diff --git a/google/cloud/securitycenter/v2/attack_path.proto b/google/cloud/securitycenter/v2/attack_path.proto
index af78ec66cf..b41641b0e1 100644
--- a/google/cloud/securitycenter/v2/attack_path.proto
+++ b/google/cloud/securitycenter/v2/attack_path.proto
@@ -31,6 +31,7 @@ message AttackPath {
   option (google.api.resource) = {
     type: "securitycenter.googleapis.com/AttackPath"
     pattern: "organizations/{organization}/simulations/{simulation}/valuedResources/{valued_resource}/attackPaths/{attack_path}"
+    pattern: "organizations/{organization}/locations/{location}/simulations/{simulation}/valuedResources/{valued_resource}/attackPaths/{attack_path}"
     plural: "attackPaths"
     singular: "attackPath"
   };
diff --git a/google/cloud/securitycenter/v2/cloud_armor.proto b/google/cloud/securitycenter/v2/cloud_armor.proto
new file mode 100644
index 0000000000..19c6b66c17
--- /dev/null
+++ b/google/cloud/securitycenter/v2/cloud_armor.proto
@@ -0,0 +1,114 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v2;
+
+import "google/protobuf/duration.proto";
+
+option csharp_namespace = "Google.Cloud.SecurityCenter.V2";
+option go_package = "cloud.google.com/go/securitycenter/apiv2/securitycenterpb;securitycenterpb";
+option java_multiple_files = true;
+option java_outer_classname = "CloudArmorProto";
+option java_package = "com.google.cloud.securitycenter.v2";
+option php_namespace = "Google\\Cloud\\SecurityCenter\\V2";
+option ruby_package = "Google::Cloud::SecurityCenter::V2";
+
+// Fields related to Google Cloud Armor findings.
+message CloudArmor {
+  // Information about the [Google Cloud Armor security
+  // policy](https://cloud.google.com/armor/docs/security-policy-overview)
+  // relevant to the finding.
+  SecurityPolicy security_policy = 1;
+
+  // Information about incoming requests evaluated by [Google Cloud Armor
+  // security
+  // policies](https://cloud.google.com/armor/docs/security-policy-overview).
+  Requests requests = 2;
+
+  // Information about potential Layer 7 DDoS attacks identified by [Google
+  // Cloud Armor Adaptive
+  // Protection](https://cloud.google.com/armor/docs/adaptive-protection-overview).
+  AdaptiveProtection adaptive_protection = 3;
+
+  // Information about DDoS attack volume and classification.
+  Attack attack = 4;
+
+  // Distinguish between volumetric & protocol DDoS attack and
+  // application layer attacks. For example, "L3_4" for Layer 3 and Layer 4 DDoS
+  // attacks, or "L_7" for Layer 7 DDoS attacks.
+  string threat_vector = 5;
+
+  // Duration of attack from the start until the current moment (updated every 5
+  // minutes).
+  google.protobuf.Duration duration = 6;
+}
+
+// Information about the [Google Cloud Armor security
+// policy](https://cloud.google.com/armor/docs/security-policy-overview)
+// relevant to the finding.
+message SecurityPolicy {
+  // The name of the Google Cloud Armor security policy, for example,
+  // "my-security-policy".
+  string name = 1;
+
+  // The type of Google Cloud Armor security policy for example, 'backend
+  // security policy', 'edge security policy', 'network edge security policy',
+  // or 'always-on DDoS protection'.
+  string type = 2;
+
+  // Whether or not the associated rule or policy is in preview mode.
+  bool preview = 3;
+}
+
+// Information about the requests relevant to the finding.
+message Requests {
+  // For 'Increasing deny ratio', the ratio is the denied traffic divided by the
+  // allowed traffic. For 'Allowed traffic spike', the ratio is the allowed
+  // traffic in the short term divided by allowed traffic in the long term.
+  double ratio = 1;
+
+  // Allowed RPS (requests per second) in the short term.
+  int32 short_term_allowed = 2;
+
+  // Allowed RPS (requests per second) over the long term.
+  int32 long_term_allowed = 3;
+
+  // Denied RPS (requests per second) over the long term.
+  int32 long_term_denied = 4;
+}
+
+// Information about [Google Cloud Armor Adaptive
+// Protection](https://cloud.google.com/armor/docs/cloud-armor-overview#google-cloud-armor-adaptive-protection).
+message AdaptiveProtection {
+  // A score of 0 means that there is low confidence that the detected event is
+  // an actual attack. A score of 1 means that there is high confidence that the
+  // detected event is an attack. See the [Adaptive Protection
+  // documentation](https://cloud.google.com/armor/docs/adaptive-protection-overview#configure-alert-tuning)
+  // for further explanation.
+  double confidence = 1;
+}
+
+// Information about DDoS attack volume and classification.
+message Attack {
+  // Total PPS (packets per second) volume of attack.
+  int32 volume_pps = 1;
+
+  // Total BPS (bytes per second) volume of attack.
+  int32 volume_bps = 2;
+
+  // Type of attack, for example, 'SYN-flood', 'NTP-udp', or 'CHARGEN-udp'.
+  string classification = 3;
+}
diff --git a/google/cloud/securitycenter/v2/finding.proto b/google/cloud/securitycenter/v2/finding.proto
index f14c6d69f6..ee5ca55c7a 100644
--- a/google/cloud/securitycenter/v2/finding.proto
+++ b/google/cloud/securitycenter/v2/finding.proto
@@ -22,6 +22,7 @@ import "google/cloud/securitycenter/v2/access.proto";
 import "google/cloud/securitycenter/v2/application.proto";
 import "google/cloud/securitycenter/v2/attack_exposure.proto";
 import "google/cloud/securitycenter/v2/backup_disaster_recovery.proto";
+import "google/cloud/securitycenter/v2/cloud_armor.proto";
 import "google/cloud/securitycenter/v2/cloud_dlp_data_profile.proto";
 import "google/cloud/securitycenter/v2/cloud_dlp_inspection.proto";
 import "google/cloud/securitycenter/v2/compliance.proto";
@@ -40,6 +41,7 @@ import "google/cloud/securitycenter/v2/kubernetes.proto";
 import "google/cloud/securitycenter/v2/load_balancer.proto";
 import "google/cloud/securitycenter/v2/log_entry.proto";
 import "google/cloud/securitycenter/v2/mitre_attack.proto";
+import "google/cloud/securitycenter/v2/notebook.proto";
 import "google/cloud/securitycenter/v2/org_policy.proto";
 import "google/cloud/securitycenter/v2/process.proto";
 import "google/cloud/securitycenter/v2/security_marks.proto";
@@ -431,6 +433,12 @@ message Finding {
   // The load balancers associated with the finding.
   repeated LoadBalancer load_balancers = 50;
 
+  // Fields related to Cloud Armor findings.
+  CloudArmor cloud_armor = 51;
+
+  // Notebook associated with the finding.
+  Notebook notebook = 55;
+
   // Contains details about a group of security issues that, when the issues
   // occur together, represent a greater risk than when the issues occur
   // independently. A group of such issues is referred to as a toxic
diff --git a/google/cloud/securitycenter/v2/folder.proto b/google/cloud/securitycenter/v2/folder.proto
new file mode 100644
index 0000000000..d965797b06
--- /dev/null
+++ b/google/cloud/securitycenter/v2/folder.proto
@@ -0,0 +1,36 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v2;
+
+option csharp_namespace = "Google.Cloud.SecurityCenter.V2";
+option go_package = "cloud.google.com/go/securitycenter/apiv2/securitycenterpb;securitycenterpb";
+option java_multiple_files = true;
+option java_outer_classname = "FolderProto";
+option java_package = "com.google.cloud.securitycenter.v2";
+option php_namespace = "Google\\Cloud\\SecurityCenter\\V2";
+option ruby_package = "Google::Cloud::SecurityCenter::V2";
+
+// Message that contains the resource name and display name of a folder
+// resource.
+message Folder {
+  // Full resource name of this folder. See:
+  // https://cloud.google.com/apis/design/resource_names#full_resource_name
+  string resource_folder = 1;
+
+  // The user defined display name for this folder.
+  string resource_folder_display_name = 2;
+}
diff --git a/google/cloud/securitycenter/v2/mitre_attack.proto b/google/cloud/securitycenter/v2/mitre_attack.proto
index 3963d6f093..7c2b56c040 100644
--- a/google/cloud/securitycenter/v2/mitre_attack.proto
+++ b/google/cloud/securitycenter/v2/mitre_attack.proto
@@ -78,7 +78,7 @@ message MitreAttack {
 
   // MITRE ATT&CK techniques that can be referenced by SCC findings.
   // See: https://attack.mitre.org/techniques/enterprise/
-  // Next ID: 59
+  // Next ID: 63
   enum Technique {
     // Unspecified value.
     TECHNIQUE_UNSPECIFIED = 0;
@@ -107,6 +107,9 @@ message MitreAttack {
     // T1059.004
     UNIX_SHELL = 7;
 
+    // T1059.006
+    PYTHON = 59;
+
     // T1069
     PERMISSION_GROUPS_DISCOVERY = 18;
 
@@ -254,8 +257,17 @@ message MitreAttack {
     // T1595.001
     SCANNING_IP_BLOCKS = 2;
 
+    // T1613
+    CONTAINER_ADMINISTRATION_COMMAND = 60;
+
+    // T1611
+    ESCAPE_TO_HOST = 61;
+
     // T1613
     CONTAINER_AND_RESOURCE_DISCOVERY = 57;
+
+    // T1649
+    STEAL_OR_FORGE_AUTHENTICATION_CERTIFICATES = 62;
   }
 
   // The MITRE ATT&CK tactic most closely represented by this finding, if any.
diff --git a/google/cloud/securitycenter/v2/notebook.proto b/google/cloud/securitycenter/v2/notebook.proto
new file mode 100644
index 0000000000..b2fd80474e
--- /dev/null
+++ b/google/cloud/securitycenter/v2/notebook.proto
@@ -0,0 +1,44 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v2;
+
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.SecurityCenter.V2";
+option go_package = "cloud.google.com/go/securitycenter/apiv2/securitycenterpb;securitycenterpb";
+option java_multiple_files = true;
+option java_outer_classname = "NotebookProto";
+option java_package = "com.google.cloud.securitycenter.v2";
+option php_namespace = "Google\\Cloud\\SecurityCenter\\V2";
+option ruby_package = "Google::Cloud::SecurityCenter::V2";
+
+// Represents a Jupyter notebook IPYNB file, such as a [Colab Enterprise
+// notebook](https://cloud.google.com/colab/docs/introduction) file, that is
+// associated with a finding.
+message Notebook {
+  // The name of the notebook.
+  string name = 1;
+
+  // The source notebook service, for example, "Colab Enterprise".
+  string service = 2;
+
+  // The user ID of the latest author to modify the notebook.
+  string last_author = 3;
+
+  // The most recent time the notebook was updated.
+  google.protobuf.Timestamp notebook_update_time = 4;
+}
diff --git a/google/cloud/securitycenter/v2/resource.proto b/google/cloud/securitycenter/v2/resource.proto
index 3738837292..0bf07600b1 100644
--- a/google/cloud/securitycenter/v2/resource.proto
+++ b/google/cloud/securitycenter/v2/resource.proto
@@ -17,6 +17,7 @@ syntax = "proto3";
 package google.cloud.securitycenter.v2;
 
 import "google/api/field_behavior.proto";
+import "google/cloud/securitycenter/v2/folder.proto";
 
 option csharp_namespace = "Google.Cloud.SecurityCenter.V2";
 option go_package = "cloud.google.com/go/securitycenter/apiv2/securitycenterpb;securitycenterpb";
@@ -37,4 +38,220 @@ message Resource {
 
   // The full resource type of the resource.
   string type = 3;
+
+  // Indicates which cloud provider the finding is from.
+  CloudProvider cloud_provider = 4;
+
+  // The service or resource provider associated with the resource.
+  string service = 5;
+
+  // The region or location of the service (if applicable).
+  string location = 6;
+
+  oneof cloud_provider_metadata {
+    // The GCP metadata associated with the finding.
+    GcpMetadata gcp_metadata = 7;
+
+    // The AWS metadata associated with the finding.
+    AwsMetadata aws_metadata = 8;
+
+    // The Azure metadata associated with the finding.
+    AzureMetadata azure_metadata = 9;
+  }
+
+  // Provides the path to the resource within the resource hierarchy.
+  ResourcePath resource_path = 10;
+
+  // A string representation of the resource path.
+  // For Google Cloud, it has the format of
+  // organizations/{organization_id}/folders/{folder_id}/folders/{folder_id}/projects/{project_id}
+  // where there can be any number of folders.
+  // For AWS, it has the format of
+  // org/{organization_id}/ou/{organizational_unit_id}/ou/{organizational_unit_id}/account/{account_id}
+  // where there can be any number of organizational units.
+  // For Azure, it has the format of
+  // mg/{management_group_id}/mg/{management_group_id}/subscription/{subscription_id}/rg/{resource_group_name}
+  // where there can be any number of management groups.
+  string resource_path_string = 11;
+}
+
+// The cloud provider the finding pertains to.
+enum CloudProvider {
+  // The cloud provider is unspecified.
+  CLOUD_PROVIDER_UNSPECIFIED = 0;
+
+  // The cloud provider is Google Cloud Platform.
+  GOOGLE_CLOUD_PLATFORM = 1;
+
+  // The cloud provider is Amazon Web Services.
+  AMAZON_WEB_SERVICES = 2;
+
+  // The cloud provider is Microsoft Azure.
+  MICROSOFT_AZURE = 3;
+}
+
+// GCP metadata associated with the resource, only applicable if the finding's
+// cloud provider is Google Cloud Platform.
+message GcpMetadata {
+  // The full resource name of project that the resource belongs to.
+  string project = 1;
+
+  // The project ID that the resource belongs to.
+  string project_display_name = 2;
+
+  // The full resource name of resource's parent.
+  string parent = 3;
+
+  // The human readable name of resource's parent.
+  string parent_display_name = 4;
+
+  // Output only. Contains a Folder message for each folder in the assets
+  // ancestry. The first folder is the deepest nested folder, and the last
+  // folder is the folder directly under the Organization.
+  repeated Folder folders = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The name of the organization that the resource belongs to.
+  string organization = 6;
+}
+
+// AWS metadata associated with the resource, only applicable if the finding's
+// cloud provider is Amazon Web Services.
+message AwsMetadata {
+  // An organization is a collection of accounts that are centrally managed
+  // together using consolidated billing, organized hierarchically with
+  // organizational units (OUs), and controlled with policies.
+  message AwsOrganization {
+    // The unique identifier (ID) for the organization. The regex pattern for an
+    // organization ID string requires "o-" followed by from 10 to 32 lowercase
+    // letters or digits.
+    string id = 1;
+  }
+
+  // An Organizational Unit (OU) is a container of AWS accounts within a root of
+  // an organization. Policies that are attached to an OU apply to all accounts
+  // contained in that OU and in any child OUs.
+  message AwsOrganizationalUnit {
+    // The unique identifier (ID) associated with this OU. The regex pattern for
+    // an organizational unit ID string requires "ou-" followed by from 4 to 32
+    // lowercase letters or digits (the ID of the root that contains the OU).
+    // This string is followed by a second "-" dash and from 8 to 32 additional
+    // lowercase letters or digits. For example, "ou-ab12-cd34ef56".
+    string id = 1;
+
+    // The friendly name of the OU.
+    string name = 2;
+  }
+
+  // An AWS account that is a member of an organization.
+  message AwsAccount {
+    // The unique identifier (ID) of the account, containing exactly 12 digits.
+    string id = 1;
+
+    // The friendly name of this account.
+    string name = 2;
+  }
+
+  // The AWS organization associated with the resource.
+  AwsOrganization organization = 1;
+
+  // A list of AWS organizational units associated with the resource, ordered
+  // from lowest level (closest to the account) to highest level.
+  repeated AwsOrganizationalUnit organizational_units = 2;
+
+  // The AWS account associated with the resource.
+  AwsAccount account = 3;
+}
+
+// Azure metadata associated with the resource, only applicable if the finding's
+// cloud provider is Microsoft Azure.
+message AzureMetadata {
+  // Represents an Azure management group.
+  message AzureManagementGroup {
+    // The UUID of the Azure management group, for example,
+    // "20000000-0001-0000-0000-000000000000".
+    string id = 1;
+
+    // The display name of the Azure management group.
+    string display_name = 2;
+  }
+
+  // Represents an Azure subscription.
+  message AzureSubscription {
+    // The UUID of the Azure subscription, for example,
+    // "291bba3f-e0a5-47bc-a099-3bdcb2a50a05".
+    string id = 1;
+
+    // The display name of the Azure subscription.
+    string display_name = 2;
+  }
+
+  // Represents an Azure resource group.
+  message AzureResourceGroup {
+    // The name of the Azure resource group. This is not a UUID.
+    string name = 1;
+  }
+
+  // A list of Azure management groups associated with the resource, ordered
+  // from lowest level (closest to the subscription) to highest level.
+  repeated AzureManagementGroup management_groups = 1;
+
+  // The Azure subscription associated with the resource.
+  AzureSubscription subscription = 2;
+
+  // The Azure resource group associated with the resource.
+  AzureResourceGroup resource_group = 3;
+}
+
+// Represents the path of resources leading up to the resource this finding is
+// about.
+message ResourcePath {
+  // The type of resource the node represents.
+  enum ResourcePathNodeType {
+    // Node type is unspecified.
+    RESOURCE_PATH_NODE_TYPE_UNSPECIFIED = 0;
+
+    // The node represents a Google Cloud organization.
+    GCP_ORGANIZATION = 1;
+
+    // The node represents a Google Cloud folder.
+    GCP_FOLDER = 2;
+
+    // The node represents a Google Cloud project.
+    GCP_PROJECT = 3;
+
+    // The node represents an AWS organization.
+    AWS_ORGANIZATION = 4;
+
+    // The node represents an AWS organizational unit.
+    AWS_ORGANIZATIONAL_UNIT = 5;
+
+    // The node represents an AWS account.
+    AWS_ACCOUNT = 6;
+
+    // The node represents an Azure management group.
+    AZURE_MANAGEMENT_GROUP = 7;
+
+    // The node represents an Azure subscription.
+    AZURE_SUBSCRIPTION = 8;
+
+    // The node represents an Azure resource group.
+    AZURE_RESOURCE_GROUP = 9;
+  }
+
+  // A node within the resource path. Each node represents a resource within the
+  // resource hierarchy.
+  message ResourcePathNode {
+    // The type of resource this node represents.
+    ResourcePathNodeType node_type = 1;
+
+    // The ID of the resource this node represents.
+    string id = 2;
+
+    // The display name of the resource this node represents.
+    string display_name = 3;
+  }
+
+  // The list of nodes that make the up resource path, ordered from lowest
+  // level to highest level.
+  repeated ResourcePathNode nodes = 1;
 }
diff --git a/google/cloud/securitycenter/v2/resource_value_config.proto b/google/cloud/securitycenter/v2/resource_value_config.proto
index ee224524d1..683fb13455 100644
--- a/google/cloud/securitycenter/v2/resource_value_config.proto
+++ b/google/cloud/securitycenter/v2/resource_value_config.proto
@@ -18,6 +18,7 @@ package google.cloud.securitycenter.v2;
 
 import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
+import "google/cloud/securitycenter/v2/resource.proto";
 import "google/protobuf/timestamp.proto";
 
 option csharp_namespace = "Google.Cloud.SecurityCenter.V2";
@@ -28,12 +29,15 @@ option java_package = "com.google.cloud.securitycenter.v2";
 option php_namespace = "Google\\Cloud\\SecurityCenter\\V2";
 option ruby_package = "Google::Cloud::SecurityCenter::V2";
 
-// A resource value config (RVC) is a mapping configuration of user's resources
-// to resource values. Used in Attack path simulations.
+// A resource value configuration (RVC) is a mapping configuration of user's
+// resources to resource values. Used in Attack path simulations.
 message ResourceValueConfig {
   option (google.api.resource) = {
     type: "securitycenter.googleapis.com/ResourceValueConfig"
     pattern: "organizations/{organization}/resourceValueConfigs/{resource_value_config}"
+    pattern: "organizations/{organization}/locations/{location}/resourceValueConfigs/{resource_value_config}"
+    plural: "resourceValueConfigs"
+    singular: "resourceValueConfig"
   };
 
   // Resource value mapping for Sensitive Data Protection findings
@@ -49,48 +53,52 @@ message ResourceValueConfig {
     ResourceValue medium_sensitivity_mapping = 2;
   }
 
-  // Name for the resource value config
+  // Name for the resource value configuration
   string name = 1;
 
   // Resource value level this expression represents
   // Only required when there is no SDP mapping in the request
   ResourceValue resource_value = 2;
 
-  // Required. Tag values combined with AND to check against.
+  // Required. Tag values combined with <code>AND</code> to check against.
   // Values in the form "tagValues/123"
-  // E.g. [ "tagValues/123", "tagValues/456", "tagValues/789" ]
+  // Example: [ "tagValues/123", "tagValues/456", "tagValues/789" ]
   // https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing
   repeated string tag_values = 3 [(google.api.field_behavior) = REQUIRED];
 
   // Apply resource_value only to resources that match resource_type.
-  // resource_type will be checked with "AND" of other resources.
-  // E.g. "storage.googleapis.com/Bucket" with resource_value "HIGH" will
-  // apply "HIGH" value only to "storage.googleapis.com/Bucket" resources.
+  // resource_type will be checked with <code>AND</code> of other resources.
+  // For example, "storage.googleapis.com/Bucket" with resource_value "HIGH"
+  // will apply "HIGH" value only to "storage.googleapis.com/Bucket" resources.
   string resource_type = 4;
 
-  // Project or folder to scope this config to.
-  // For example, "project/456" would apply this config only to resources in
-  // "project/456"
-  // scope will be checked with "AND" of other resources.
+  // Project or folder to scope this configuration to.
+  // For example, "project/456" would apply this configuration only to resources
+  // in "project/456" scope will be checked with <code>AND</code> of other
+  // resources.
   string scope = 5;
 
-  // List of resource labels to search for, evaluated with AND.
-  // E.g. "resource_labels_selector": {"key": "value", "env": "prod"}
-  // will match resources with labels "key": "value" AND "env": "prod"
+  // List of resource labels to search for, evaluated with <code>AND</code>.
+  // For example, "resource_labels_selector": {"key": "value", "env": "prod"}
+  // will match resources with labels "key": "value" <code>AND</code> "env":
+  // "prod"
   // https://cloud.google.com/resource-manager/docs/creating-managing-labels
   map<string, string> resource_labels_selector = 6;
 
-  // Description of the resource value config.
+  // Description of the resource value configuration.
   string description = 7;
 
-  // Output only. Timestamp this resource value config was created.
+  // Output only. Timestamp this resource value configuration was created.
   google.protobuf.Timestamp create_time = 8
       [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Output only. Timestamp this resource value config was last updated.
+  // Output only. Timestamp this resource value configuration was last updated.
   google.protobuf.Timestamp update_time = 9
       [(google.api.field_behavior) = OUTPUT_ONLY];
 
+  // Cloud provider this configuration applies to
+  CloudProvider cloud_provider = 10;
+
   // A mapping of the sensitivity on Sensitive Data Protection finding to
   // resource values. This mapping can only be used in combination with a
   // resource_type that is related to BigQuery, e.g.
diff --git a/google/cloud/securitycenter/v2/securitycenter_service.proto b/google/cloud/securitycenter/v2/securitycenter_service.proto
index cfb1745331..f14bfaa8e1 100644
--- a/google/cloud/securitycenter/v2/securitycenter_service.proto
+++ b/google/cloud/securitycenter/v2/securitycenter_service.proto
@@ -27,6 +27,7 @@ import "google/cloud/securitycenter/v2/external_system.proto";
 import "google/cloud/securitycenter/v2/finding.proto";
 import "google/cloud/securitycenter/v2/mute_config.proto";
 import "google/cloud/securitycenter/v2/notification_config.proto";
+import "google/cloud/securitycenter/v2/resource.proto";
 import "google/cloud/securitycenter/v2/resource_value_config.proto";
 import "google/cloud/securitycenter/v2/security_marks.proto";
 import "google/cloud/securitycenter/v2/simulation.proto";
@@ -54,6 +55,10 @@ option (google.api.resource_definition) = {
   type: "securitycenter.googleapis.com/FolderLocation"
   pattern: "folders/{folder}/locations/{location}"
 };
+option (google.api.resource_definition) = {
+  type: "securitycenter.googleapis.com/OrganizationValuedResource"
+  pattern: "organizations/{organization}/locations/{location}/simulations/{simulation}/valuedResources/{valued_resource}"
+};
 
 // V2 APIs for Security Center service.
 service SecurityCenter {
@@ -68,6 +73,10 @@ service SecurityCenter {
     option (google.api.http) = {
       post: "/v2/{parent=organizations/*}/resourceValueConfigs:batchCreate"
       body: "*"
+      additional_bindings {
+        post: "/v2/{parent=organizations/*/locations/*}/resourceValueConfigs:batchCreate"
+        body: "*"
+      }
     };
     option (google.api.method_signature) = "parent,requests";
   }
@@ -283,6 +292,9 @@ service SecurityCenter {
       returns (google.protobuf.Empty) {
     option (google.api.http) = {
       delete: "/v2/{name=organizations/*/resourceValueConfigs/*}"
+      additional_bindings {
+        delete: "/v2/{name=organizations/*/locations/*/resourceValueConfigs/*}"
+      }
     };
     option (google.api.method_signature) = "name";
   }
@@ -306,6 +318,9 @@ service SecurityCenter {
   rpc GetSimulation(GetSimulationRequest) returns (Simulation) {
     option (google.api.http) = {
       get: "/v2/{name=organizations/*/simulations/*}"
+      additional_bindings {
+        get: "/v2/{name=organizations/*/locations/*/simulations/*}"
+      }
     };
     option (google.api.method_signature) = "name";
   }
@@ -314,6 +329,9 @@ service SecurityCenter {
   rpc GetValuedResource(GetValuedResourceRequest) returns (ValuedResource) {
     option (google.api.http) = {
       get: "/v2/{name=organizations/*/simulations/*/valuedResources/*}"
+      additional_bindings {
+        get: "/v2/{name=organizations/*/locations/*/simulations/*/valuedResources/*}"
+      }
     };
     option (google.api.method_signature) = "name";
   }
@@ -382,6 +400,9 @@ service SecurityCenter {
       returns (ResourceValueConfig) {
     option (google.api.http) = {
       get: "/v2/{name=organizations/*/resourceValueConfigs/*}"
+      additional_bindings {
+        get: "/v2/{name=organizations/*/locations/*/resourceValueConfigs/*}"
+      }
     };
     option (google.api.method_signature) = "name";
   }
@@ -445,9 +466,15 @@ service SecurityCenter {
       additional_bindings {
         get: "/v2/{parent=organizations/*/simulations/*/valuedResources/*}/attackPaths"
       }
+      additional_bindings {
+        get: "/v2/{parent=organizations/*/locations/*/simulations/*/valuedResources/*}/attackPaths"
+      }
       additional_bindings {
         get: "/v2/{parent=organizations/*/simulations/*/attackExposureResults/*}/attackPaths"
       }
+      additional_bindings {
+        get: "/v2/{parent=organizations/*/locations/*/simulations/*/attackExposureResults/*}/attackPaths"
+      }
     };
     option (google.api.method_signature) = "parent";
   }
@@ -553,6 +580,9 @@ service SecurityCenter {
       returns (ListResourceValueConfigsResponse) {
     option (google.api.http) = {
       get: "/v2/{parent=organizations/*}/resourceValueConfigs"
+      additional_bindings {
+        get: "/v2/{parent=organizations/*/locations/*}/resourceValueConfigs"
+      }
     };
     option (google.api.method_signature) = "parent";
   }
@@ -808,6 +838,10 @@ service SecurityCenter {
     option (google.api.http) = {
       patch: "/v2/{resource_value_config.name=organizations/*/resourceValueConfigs/*}"
       body: "resource_value_config"
+      additional_bindings {
+        patch: "/v2/{resource_value_config.name=organizations/*/locations/*/resourceValueConfigs/*}"
+        body: "resource_value_config"
+      }
     };
     option (google.api.method_signature) = "resource_value_config,update_mask";
   }
@@ -1295,14 +1329,6 @@ message GroupFindingsRequest {
   // Required. Expression that defines what assets fields to use for grouping.
   // The string value should follow SQL syntax: comma separated list of fields.
   // For example: "parent,resource_name".
-  //
-  // The following fields are supported:
-  //
-  // * resource_name
-  // * category
-  // * state
-  // * parent
-  // * severity
   string group_by = 3 [(google.api.field_behavior) = REQUIRED];
 
   // The value returned by the last `GroupFindingsResponse`; indicates
@@ -1580,6 +1606,41 @@ message ListFindingsResponse {
 
       // The full resource type of the resource.
       string type = 3;
+
+      // Indicates which cloud provider the finding is from.
+      CloudProvider cloud_provider = 4;
+
+      // The service or resource provider associated with the resource.
+      string service = 5;
+
+      // The region or location of the service (if applicable).
+      string location = 6;
+
+      oneof cloud_provider_metadata {
+        // The GCP metadata associated with the finding.
+        GcpMetadata gcp_metadata = 7;
+
+        // The AWS metadata associated with the finding.
+        AwsMetadata aws_metadata = 8;
+
+        // The Azure metadata associated with the finding.
+        AzureMetadata azure_metadata = 9;
+      }
+
+      // Provides the path to the resource within the resource hierarchy.
+      ResourcePath resource_path = 10;
+
+      // A string representation of the resource path.
+      // For Google Cloud, it has the format of
+      // organizations/{organization_id}/folders/{folder_id}/folders/{folder_id}/projects/{project_id}
+      // where there can be any number of folders.
+      // For AWS, it has the format of
+      // org/{organization_id}/ou/{organizational_unit_id}/ou/{organizational_unit_id}/account/{account_id}
+      // where there can be any number of organizational units.
+      // For Azure, it has the format of
+      // mg/{management_group_id}/mg/{management_group_id}/subscription/{subscription_id}/rg/{resource_group_name}
+      // where there can be any number of management groups.
+      string resource_path_string = 11;
     }
 
     // Finding matching the search request.
@@ -1936,6 +1997,10 @@ message UpdateResourceValueConfigRequest {
 
   // The list of fields to be updated.
   // If empty all mutable fields will be updated.
+  //
+  // To update nested fields, include the top level field in the mask
+  // For example, to update gcp_metadata.resource_type, include the
+  // "gcp_metadata" field mask
   google.protobuf.FieldMask update_mask = 2;
 }
 
diff --git a/google/cloud/securitycenter/v2/simulation.proto b/google/cloud/securitycenter/v2/simulation.proto
index 8656e373e3..d682d7cbf9 100644
--- a/google/cloud/securitycenter/v2/simulation.proto
+++ b/google/cloud/securitycenter/v2/simulation.proto
@@ -18,6 +18,7 @@ package google.cloud.securitycenter.v2;
 
 import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
+import "google/cloud/securitycenter/v2/resource.proto";
 import "google/cloud/securitycenter/v2/valued_resource.proto";
 import "google/protobuf/timestamp.proto";
 
@@ -34,6 +35,7 @@ message Simulation {
   option (google.api.resource) = {
     type: "securitycenter.googleapis.com/Simulation"
     pattern: "organizations/{organization}/simulations/{simulation}"
+    pattern: "organizations/{organization}/locations/{location}/simulations/{simluation}"
     plural: "simulations"
     singular: "simulation"
   };
@@ -49,4 +51,7 @@ message Simulation {
   // Resource value configurations' metadata used in this simulation. Maximum of
   // 100.
   repeated ResourceValueConfigMetadata resource_value_configs_metadata = 3;
+
+  // Indicates which cloud provider was used in this simulation.
+  CloudProvider cloud_provider = 4;
 }
diff --git a/google/cloud/securitycenter/v2/valued_resource.proto b/google/cloud/securitycenter/v2/valued_resource.proto
index a2efdde529..994918b58d 100644
--- a/google/cloud/securitycenter/v2/valued_resource.proto
+++ b/google/cloud/securitycenter/v2/valued_resource.proto
@@ -31,6 +31,7 @@ message ValuedResource {
   option (google.api.resource) = {
     type: "securitycenter.googleapis.com/ValuedResource"
     pattern: "organizations/{organization}/simulations/{simulation}/valuedResources/{valued_resource}"
+    pattern: "organizations/{organization}/locations/{location}/simulations/{simluation}/valuedResources/{valued_resource}"
     plural: "valuedResources"
     singular: "valuedResource"
   };