Skip to content

Commit 36a885f

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add cloud_dlp_inspection and cloud_dlp_data_profile fields to finding's list of attributes
docs: miscellaneous style improvements PiperOrigin-RevId: 525798516
1 parent d3ceec8 commit 36a885f

6 files changed

Lines changed: 170 additions & 62 deletions

File tree

‎google/cloud/securitycenter/v1/BUILD.bazel‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ proto_library(
2424
"access.proto",
2525
"asset.proto",
2626
"bigquery_export.proto",
27+
"cloud_dlp_data_profile.proto",
28+
"cloud_dlp_inspection.proto",
2729
"compliance.proto",
2830
"connection.proto",
2931
"contact_details.proto",

‎google/cloud/securitycenter/v1/access.proto‎

Lines changed: 28 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,11 @@ option ruby_package = "Google::Cloud::SecurityCenter::V1";
2828
message Access {
2929
// Associated email, such as "[email protected]".
3030
//
31-
// The email address of the authenticated user (or service account on behalf
32-
// of third party principal) making the request. For third party identity
33-
// callers, the `principal_subject` field is populated instead of this field.
34-
// For privacy reasons, the principal email address is sometimes redacted.
35-
// For more information, see [Caller identities in audit
31+
// The email address of the authenticated user or a service account acting on
32+
// behalf of a third party principal making the request. For third party
33+
// identity callers, the `principal_subject` field is populated instead of
34+
// this field. For privacy reasons, the principal email address is sometimes
35+
// redacted. For more information, see [Caller identities in audit
3636
// logs](https://cloud.google.com/logging/docs/audit#user-id).
3737
string principal_email = 1;
3838

@@ -42,8 +42,8 @@ message Access {
4242
// The caller IP's geolocation, which identifies where the call came from.
4343
Geolocation caller_ip_geo = 3;
4444

45-
// What kind of user agent is associated, for example operating system shells,
46-
// embedded or stand-alone applications, etc.
45+
// Type of user agent associated with the finding. For example, an operating
46+
// system shell or an embedded or standalone application.
4747
string user_agent_family = 4;
4848

4949
// This is the API service that the service account made a call to, e.g.
@@ -53,37 +53,36 @@ message Access {
5353
// The method that the service account called, e.g. "SetIamPolicy".
5454
string method_name = 6;
5555

56-
// A string representing the principal_subject associated with the identity.
57-
// As compared to `principal_email`, supports principals that aren't
58-
// associated with email addresses, such as third party principals. For most
59-
// identities, the format will be `principal://iam.googleapis.com/{identity
60-
// pool name}/subjects/{subject}` except for some GKE identities
61-
// (GKE_WORKLOAD, FREEFORM, GKE_HUB_WORKLOAD) that are still in the legacy
62-
// format `serviceAccount:{identity pool name}[{subject}]`
56+
// A string that represents the principal_subject that is associated with the
57+
// identity. Unlike `principal_email`, `principal_subject` supports principals
58+
// that aren't associated with email addresses, such as third party
59+
// principals. For most identities, the format is
60+
// `principal://iam.googleapis.com/{identity pool name}/subject/{subject}`.
61+
// Some GKE identities, such as GKE_WORKLOAD, FREEFORM, and GKE_HUB_WORKLOAD,
62+
// still use the legacy format `serviceAccount:{identity pool
63+
// name}[{subject}]`.
6364
string principal_subject = 7;
6465

65-
// The name of the service account key used to create or exchange
66-
// credentials for authenticating the service account making the request.
66+
// The name of the service account key that was used to create or exchange
67+
// credentials when authenticating the service account that made the request.
6768
// This is a scheme-less URI full resource name. For example:
6869
//
69-
// "//iam.googleapis.com/projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}"
70+
// "//iam.googleapis.com/projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}".
7071
//
7172
string service_account_key_name = 8;
7273

73-
// Identity delegation history of an authenticated service account that makes
74-
// the request. It contains information on the real authorities that try to
75-
// access GCP resources by delegating on a service account. When multiple
76-
// authorities are present, they are guaranteed to be sorted based on the
77-
// original ordering of the identity delegation events.
74+
// The identity delegation history of an authenticated service account that
75+
// made the request. The `serviceAccountDelegationInfo[]` object contains
76+
// information about the real authorities that try to access Google Cloud
77+
// resources by delegating on a service account. When multiple authorities are
78+
// present, they are guaranteed to be sorted based on the original ordering of
79+
// the identity delegation events.
7880
repeated ServiceAccountDelegationInfo service_account_delegation_info = 9;
7981

80-
// A string that represents the username of a user, user account, or other
81-
// entity involved in the access event. What the entity is and what its role
82-
// in the access event is depends on the finding that this field appears in.
83-
// The entity is likely not an IAM principal, but could be a user that is
84-
// logged into an operating system, if the finding is VM-related, or a user
85-
// that is logged into some type of application that is involved in the
86-
// access event.
82+
// A string that represents a username. The username provided depends on the
83+
// type of the finding and is likely not an IAM principal. For example, this
84+
// can be a system username if the finding is related to a virtual machine, or
85+
// it can be an application login username.
8786
string user_name = 11;
8887
}
8988

‎google/cloud/securitycenter/v1/cloud_dlp_data_profile.proto‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Copyright 2023 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/api/resource.proto";
20+
21+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
22+
option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
23+
option java_multiple_files = true;
24+
option java_outer_classname = "CloudDlpDataProfileProto";
25+
option java_package = "com.google.cloud.securitycenter.v1";
26+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
27+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
28+
option (google.api.resource_definition) = {
29+
type: "dlp.googleapis.com/TableDataProfile"
30+
pattern: "projects/{project}/tableProfiles/{table_profile}"
31+
pattern: "projects/{project}/locations/{location}/tableProfiles/{table_profile}"
32+
};
33+
34+
// The [data profile](https://cloud.google.com/dlp/docs/data-profiles)
35+
// associated with the finding.
36+
message CloudDlpDataProfile {
37+
// Name of the data profile, for example,
38+
// `projects/123/locations/europe/tableProfiles/8383929`.
39+
string data_profile = 1 [(google.api.resource_reference) = {
40+
type: "dlp.googleapis.com/TableDataProfile"
41+
}];
42+
}

‎google/cloud/securitycenter/v1/cloud_dlp_inspection.proto‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
// Copyright 2023 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/api/resource.proto";
20+
21+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
22+
option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
23+
option java_multiple_files = true;
24+
option java_outer_classname = "CloudDlpInspectionProto";
25+
option java_package = "com.google.cloud.securitycenter.v1";
26+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
27+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
28+
option (google.api.resource_definition) = {
29+
type: "dlp.googleapis.com/DlpJob"
30+
pattern: "projects/{project}/dlpJobs/{dlp_job}"
31+
pattern: "projects/{project}/locations/{location}/dlpJobs/{dlp_job}"
32+
};
33+
34+
// Details about the Cloud Data Loss Prevention (Cloud DLP) [inspection
35+
// job](https://cloud.google.com/dlp/docs/concepts-job-triggers) that produced
36+
// the finding.
37+
message CloudDlpInspection {
38+
// Name of the inspection job, for example,
39+
// `projects/123/locations/europe/dlpJobs/i-8383929`.
40+
string inspect_job = 1
41+
[(google.api.resource_reference) = { type: "dlp.googleapis.com/DlpJob" }];
42+
43+
// The [type of
44+
// information](https://cloud.google.com/dlp/docs/infotypes-reference) found,
45+
// for example, `EMAIL_ADDRESS` or `STREET_ADDRESS`.
46+
string info_type = 2;
47+
48+
// The number of times Cloud DLP found this infoType within this job
49+
// and resource.
50+
int64 info_type_count = 3;
51+
52+
// Whether Cloud DLP scanned the complete resource or a sampled subset.
53+
bool full_scan = 4;
54+
}

‎google/cloud/securitycenter/v1/finding.proto‎

Lines changed: 32 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ package google.cloud.securitycenter.v1;
1919
import "google/api/field_behavior.proto";
2020
import "google/api/resource.proto";
2121
import "google/cloud/securitycenter/v1/access.proto";
22+
import "google/cloud/securitycenter/v1/cloud_dlp_data_profile.proto";
23+
import "google/cloud/securitycenter/v1/cloud_dlp_inspection.proto";
2224
import "google/cloud/securitycenter/v1/compliance.proto";
2325
import "google/cloud/securitycenter/v1/connection.proto";
2426
import "google/cloud/securitycenter/v1/contact_details.proto";
@@ -84,7 +86,8 @@ message Finding {
8486
// exploitable, and results in the direct ability to execute arbitrary code,
8587
// exfiltrate data, and otherwise gain additional access and privileges to
8688
// cloud resources and workloads. Examples include publicly accessible
87-
// unprotected user data, public SSH access with weak or no passwords, etc.
89+
// unprotected user data and public SSH access with weak or no
90+
// passwords.
8891
//
8992
// Threat:
9093
// Indicates a threat that is able to access, modify, or delete data or
@@ -170,10 +173,12 @@ message Finding {
170173
SCC_ERROR = 5;
171174
}
172175

173-
// The relative resource name of this finding. See:
174-
// https://cloud.google.com/apis/design/resource_names#relative_resource_name
175-
// Example:
176-
// "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}"
176+
// The [relative resource
177+
// name](https://cloud.google.com/apis/design/resource_names#relative_resource_name)
178+
// of the finding. Example:
179+
// "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}",
180+
// "folders/{folder_id}/sources/{source_id}/findings/{finding_id}",
181+
// "projects/{project_id}/sources/{source_id}/findings/{finding_id}".
177182
string name = 1;
178183

179184
// The relative resource name of the source the finding belongs to. See:
@@ -247,11 +252,11 @@ message Finding {
247252
// The class of the finding.
248253
FindingClass finding_class = 17;
249254

250-
// Represents what's commonly known as an Indicator of compromise (IoC) in
255+
// Represents what's commonly known as an *indicator of compromise* (IoC) in
251256
// computer forensics. This is an artifact observed on a network or in an
252257
// operating system that, with high confidence, indicates a computer
253-
// intrusion.
254-
// Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
258+
// intrusion. For more information, see [Indicator of
259+
// compromise](https://en.wikipedia.org/wiki/Indicator_of_compromise).
255260
Indicator indicator = 18;
256261

257262
// Represents vulnerability-specific fields like CVE and CVSS scores.
@@ -272,17 +277,16 @@ message Finding {
272277
// See: https://attack.mitre.org
273278
MitreAttack mitre_attack = 25;
274279

275-
// Access details associated to the Finding, such as more information on the
276-
// caller, which method was accessed, from where, etc.
280+
// Access details associated with the finding, such as more information on the
281+
// caller, which method was accessed, and from where.
277282
Access access = 26;
278283

279284
// Contains information about the IP connection associated with the finding.
280285
repeated Connection connections = 31;
281286

282-
// First known as mute_annotation. Records additional information about the
283-
// mute operation e.g. mute config that muted the finding, user who muted the
284-
// finding, etc. Unlike other attributes of a finding, a finding provider
285-
// shouldn't set the value of mute.
287+
// Records additional information about the mute operation, for example, the
288+
// [mute configuration](/security-command-center/docs/how-to-mute-findings)
289+
// that muted the finding and the user who muted the finding.
286290
string mute_initiator = 28;
287291

288292
// Represents operating system processes associated with the Finding.
@@ -316,25 +320,25 @@ message Finding {
316320
// "Event Threat Detection" or "Security Health Analytics".
317321
string parent_display_name = 36 [(google.api.field_behavior) = OUTPUT_ONLY];
318322

319-
// Contains more detail about the finding.
323+
// Contains more details about the finding.
320324
string description = 37;
321325

322-
// Represents exfiltration associated with the Finding.
326+
// Represents exfiltrations associated with the finding.
323327
Exfiltration exfiltration = 38;
324328

325-
// Represents IAM bindings associated with the Finding.
329+
// Represents IAM bindings associated with the finding.
326330
repeated IamBinding iam_bindings = 39;
327331

328-
// Next steps associate to the finding.
332+
// Steps to address the finding.
329333
string next_steps = 40;
330334

331335
// Unique identifier of the module which generated the finding.
332336
// Example:
333337
// folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885
334338
string module_name = 41;
335339

336-
// Containers associated with the finding. containers provides information
337-
// for both Kubernetes and non-Kubernetes containers.
340+
// Containers associated with the finding. This field provides information for
341+
// both Kubernetes and non-Kubernetes containers.
338342
repeated Container containers = 42;
339343

340344
// Kubernetes resources associated with the finding.
@@ -346,6 +350,13 @@ message Finding {
346350
// File associated with the finding.
347351
repeated File files = 46;
348352

349-
// Kernel Rootkit signature.
353+
// Cloud Data Loss Prevention (Cloud DLP) inspection results that are
354+
// associated with the finding.
355+
CloudDlpInspection cloud_dlp_inspection = 48;
356+
357+
// Cloud DLP data profile that is associated with the finding.
358+
CloudDlpDataProfile cloud_dlp_data_profile = 49;
359+
360+
// Signature of the kernel rootkit.
350361
KernelRootkit kernel_rootkit = 50;
351362
}

0 commit comments

Comments
 (0)