Skip to content

Commit 4c1b56f

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Add BigQuery export APIs that help you enable writing new/updated findings from Security Command Center to a BigQuery table in near-real time. You can then integrate the data into existing workflows and create custom analyses. You can enable this feature at the organization, folder, and project levels to export findings based on your requirements
PiperOrigin-RevId: 431905699
1 parent 47a7288 commit 4c1b56f

8 files changed

Lines changed: 600 additions & 184 deletions

File tree

‎google/cloud/securitycenter/v1/BUILD.bazel‎

Lines changed: 36 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -9,24 +9,56 @@
99
# * extra_protoc_file_parameters
1010
# The complete list of preserved parameters can be found in the source code.
1111

12-
# This is an API workspace, having public visibility by default makes perfect sense.
13-
package(default_visibility = ["//visibility:public"])
14-
1512
##############################################################################
1613
# Common
1714
##############################################################################
1815
load("@rules_proto//proto:defs.bzl", "proto_library")
19-
load("@com_google_googleapis_imports//:imports.bzl", "proto_library_with_info")
16+
load(
17+
"@com_google_googleapis_imports//:imports.bzl",
18+
"cc_grpc_library",
19+
"cc_proto_library",
20+
"csharp_gapic_assembly_pkg",
21+
"csharp_gapic_library",
22+
"csharp_grpc_library",
23+
"csharp_proto_library",
24+
"go_gapic_assembly_pkg",
25+
"go_gapic_library",
26+
"go_proto_library",
27+
"go_test",
28+
"java_gapic_assembly_gradle_pkg",
29+
"java_gapic_library",
30+
"java_gapic_test",
31+
"java_grpc_library",
32+
"java_proto_library",
33+
"nodejs_gapic_assembly_pkg",
34+
"nodejs_gapic_library",
35+
"php_gapic_assembly_pkg",
36+
"php_gapic_library",
37+
"php_grpc_library",
38+
"php_proto_library",
39+
"proto_library_with_info",
40+
"py_gapic_assembly_pkg",
41+
"py_gapic_library",
42+
"ruby_cloud_gapic_library",
43+
"ruby_gapic_assembly_pkg",
44+
"ruby_grpc_library",
45+
"ruby_proto_library",
46+
)
47+
48+
# This is an API workspace, having public visibility by default makes perfect sense.
49+
package(default_visibility = ["//visibility:public"])
2050

2151
proto_library(
2252
name = "securitycenter_proto",
2353
srcs = [
2454
"access.proto",
2555
"asset.proto",
56+
"bigquery_export.proto",
2657
"external_system.proto",
2758
"finding.proto",
2859
"folder.proto",
2960
"indicator.proto",
61+
"mitre_attack.proto",
3062
"mute_config.proto",
3163
"notification_config.proto",
3264
"notification_message.proto",
@@ -62,18 +94,6 @@ proto_library_with_info(
6294
],
6395
)
6496

65-
##############################################################################
66-
# Java
67-
##############################################################################
68-
load(
69-
"@com_google_googleapis_imports//:imports.bzl",
70-
"java_gapic_assembly_gradle_pkg",
71-
"java_gapic_library",
72-
"java_gapic_test",
73-
"java_grpc_library",
74-
"java_proto_library",
75-
)
76-
7797
java_proto_library(
7898
name = "securitycenter_java_proto",
7999
deps = [":securitycenter_proto"],
@@ -121,17 +141,6 @@ java_gapic_assembly_gradle_pkg(
121141
],
122142
)
123143

124-
##############################################################################
125-
# Go
126-
##############################################################################
127-
load(
128-
"@com_google_googleapis_imports//:imports.bzl",
129-
"go_gapic_assembly_pkg",
130-
"go_gapic_library",
131-
"go_proto_library",
132-
"go_test",
133-
)
134-
135144
go_proto_library(
136145
name = "securitycenter_go_proto",
137146
compilers = ["@io_bazel_rules_go//proto:go_grpc"],
@@ -180,15 +189,6 @@ go_gapic_assembly_pkg(
180189
],
181190
)
182191

183-
##############################################################################
184-
# Python
185-
##############################################################################
186-
load(
187-
"@com_google_googleapis_imports//:imports.bzl",
188-
"py_gapic_assembly_pkg",
189-
"py_gapic_library",
190-
)
191-
192192
py_gapic_library(
193193
name = "securitycenter_py_gapic",
194194
srcs = [":securitycenter_proto"],
@@ -203,17 +203,6 @@ py_gapic_assembly_pkg(
203203
],
204204
)
205205

206-
##############################################################################
207-
# PHP
208-
##############################################################################
209-
load(
210-
"@com_google_googleapis_imports//:imports.bzl",
211-
"php_gapic_assembly_pkg",
212-
"php_gapic_library",
213-
"php_grpc_library",
214-
"php_proto_library",
215-
)
216-
217206
php_proto_library(
218207
name = "securitycenter_php_proto",
219208
deps = [":securitycenter_proto"],
@@ -246,15 +235,6 @@ php_gapic_assembly_pkg(
246235
],
247236
)
248237

249-
##############################################################################
250-
# Node.js
251-
##############################################################################
252-
load(
253-
"@com_google_googleapis_imports//:imports.bzl",
254-
"nodejs_gapic_assembly_pkg",
255-
"nodejs_gapic_library",
256-
)
257-
258238
nodejs_gapic_library(
259239
name = "securitycenter_nodejs_gapic",
260240
package_name = "@google-cloud/security-center",
@@ -274,17 +254,6 @@ nodejs_gapic_assembly_pkg(
274254
],
275255
)
276256

277-
##############################################################################
278-
# Ruby
279-
##############################################################################
280-
load(
281-
"@com_google_googleapis_imports//:imports.bzl",
282-
"ruby_cloud_gapic_library",
283-
"ruby_gapic_assembly_pkg",
284-
"ruby_grpc_library",
285-
"ruby_proto_library",
286-
)
287-
288257
ruby_proto_library(
289258
name = "securitycenter_ruby_proto",
290259
deps = [":securitycenter_proto"],
@@ -325,17 +294,6 @@ ruby_gapic_assembly_pkg(
325294
],
326295
)
327296

328-
##############################################################################
329-
# C#
330-
##############################################################################
331-
load(
332-
"@com_google_googleapis_imports//:imports.bzl",
333-
"csharp_gapic_assembly_pkg",
334-
"csharp_gapic_library",
335-
"csharp_grpc_library",
336-
"csharp_proto_library",
337-
)
338-
339297
csharp_proto_library(
340298
name = "securitycenter_csharp_proto",
341299
deps = [":securitycenter_proto"],
@@ -369,15 +327,6 @@ csharp_gapic_assembly_pkg(
369327
],
370328
)
371329

372-
##############################################################################
373-
# C++
374-
##############################################################################
375-
load(
376-
"@com_google_googleapis_imports//:imports.bzl",
377-
"cc_grpc_library",
378-
"cc_proto_library",
379-
)
380-
381330
cc_proto_library(
382331
name = "securitycenter_cc_proto",
383332
deps = [":securitycenter_proto"],

‎google/cloud/securitycenter/v1/access.proto‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@ syntax = "proto3";
1616

1717
package google.cloud.securitycenter.v1;
1818

19-
import "google/api/annotations.proto";
20-
2119
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
2220
option java_multiple_files = true;
2321
option java_outer_classname = "AccessProto";

‎google/cloud/securitycenter/v1/bigquery_export.proto‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/api/field_behavior.proto";
20+
import "google/api/resource.proto";
21+
import "google/protobuf/timestamp.proto";
22+
23+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
24+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
25+
option java_multiple_files = true;
26+
option java_outer_classname = "BigQueryExportProto";
27+
option java_package = "com.google.cloud.securitycenter.v1";
28+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
29+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
30+
31+
// Configures how to deliver Findings to BigQuery Instance.
32+
message BigQueryExport {
33+
option (google.api.resource) = {
34+
type: "securitycenter.googleapis.com/BigQueryExport"
35+
pattern: "organizations/{organization}/bigQueryExports/{export}"
36+
pattern: "folders/{folder}/bigQueryExports/{export}"
37+
pattern: "projects/{project}/bigQueryExports/{export}"
38+
};
39+
40+
// The relative resource name of this export. See:
41+
// https://cloud.google.com/apis/design/resource_names#relative_resource_name.
42+
// Example format:
43+
// "organizations/{organization_id}/bigQueryExports/{export_id}" Example
44+
// format: "folders/{folder_id}/bigQueryExports/{export_id}" Example format:
45+
// "projects/{project_id}/bigQueryExports/{export_id}"
46+
// This field is provided in responses, and is ignored when provided in create
47+
// requests.
48+
string name = 1;
49+
50+
// The description of the export (max of 1024 characters).
51+
string description = 2;
52+
53+
// Expression that defines the filter to apply across create/update events
54+
// of findings. The expression is a list of zero or more restrictions combined
55+
// via logical operators `AND` and `OR`. Parentheses are supported, and `OR`
56+
// has higher precedence than `AND`.
57+
//
58+
// Restrictions have the form `<field> <operator> <value>` and may have a
59+
// `-` character in front of them to indicate negation. The fields map to
60+
// those defined in the corresponding resource.
61+
//
62+
// The supported operators are:
63+
//
64+
// * `=` for all value types.
65+
// * `>`, `<`, `>=`, `<=` for integer values.
66+
// * `:`, meaning substring matching, for strings.
67+
//
68+
// The supported value types are:
69+
//
70+
// * string literals in quotes.
71+
// * integer literals without quotes.
72+
// * boolean literals `true` and `false` without quotes.
73+
string filter = 3;
74+
75+
// The dataset to write findings' updates to. Its format is
76+
// "projects/[project_id]/datasets/[bigquery_dataset_id]".
77+
// BigQuery Dataset unique ID must contain only letters (a-z, A-Z), numbers
78+
// (0-9), or underscores (_).
79+
string dataset = 4;
80+
81+
// Output only. The time at which the big query export was created.
82+
// This field is set by the server and will be ignored if provided on export
83+
// on creation.
84+
google.protobuf.Timestamp create_time = 5
85+
[(google.api.field_behavior) = OUTPUT_ONLY];
86+
87+
// Output only. The most recent time at which the big export was updated.
88+
// This field is set by the server and will be ignored if provided on export
89+
// creation or update.
90+
google.protobuf.Timestamp update_time = 6
91+
[(google.api.field_behavior) = OUTPUT_ONLY];
92+
93+
// Output only. Email address of the user who last edited the big query
94+
// export. This field is set by the server and will be ignored if provided on
95+
// export creation or update.
96+
string most_recent_editor = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
97+
98+
// Output only. The service account that needs permission to create table,
99+
// upload data to the big query dataset.
100+
string principal = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
101+
}

‎google/cloud/securitycenter/v1/finding.proto‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import "google/api/resource.proto";
2121
import "google/cloud/securitycenter/v1/access.proto";
2222
import "google/cloud/securitycenter/v1/external_system.proto";
2323
import "google/cloud/securitycenter/v1/indicator.proto";
24+
import "google/cloud/securitycenter/v1/mitre_attack.proto";
2425
import "google/cloud/securitycenter/v1/security_marks.proto";
2526
import "google/cloud/securitycenter/v1/vulnerability.proto";
2627
import "google/protobuf/struct.proto";
@@ -153,6 +154,9 @@ message Finding {
153154

154155
// Describes a security observation that is for informational purposes.
155156
OBSERVATION = 4;
157+
158+
// Describes an error that prevents some SCC functionality.
159+
SCC_ERROR = 5;
156160
}
157161

158162
// The relative resource name of this finding. See:
@@ -245,11 +249,17 @@ message Finding {
245249
Vulnerability vulnerability = 20;
246250

247251
// Output only. The most recent time this finding was muted or unmuted.
248-
google.protobuf.Timestamp mute_update_time = 21 [(google.api.field_behavior) = OUTPUT_ONLY];
252+
google.protobuf.Timestamp mute_update_time = 21
253+
[(google.api.field_behavior) = OUTPUT_ONLY];
254+
255+
// Output only. Third party SIEM/SOAR fields within SCC, contains external
256+
// system information and external system finding fields.
257+
map<string, ExternalSystem> external_systems = 22
258+
[(google.api.field_behavior) = OUTPUT_ONLY];
249259

250-
// Output only. Third party SIEM/SOAR fields within SCC, contains external system
251-
// information and external system finding fields.
252-
map<string, ExternalSystem> external_systems = 22 [(google.api.field_behavior) = OUTPUT_ONLY];
260+
// MITRE ATT&CK tactics and techniques related to this finding.
261+
// See: https://attack.mitre.org
262+
MitreAttack mitre_attack = 25;
253263

254264
// Access details associated to the Finding, such as more information on the
255265
// caller, which method was accessed, from where, etc.

0 commit comments

Comments
 (0)