Skip to content

Commit 5bf36f2

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add finding_class and indicator fields in Finding
finding_class field is added in order to help our customer to quickly identify and categorize the different findings (threat, vulnerability, misconfiguration, ...). And indicator field is generated to indicate the domain and IP addresses that is causing the threat. PiperOrigin-RevId: 386975549
1 parent 9cd96ae commit 5bf36f2

4 files changed

Lines changed: 148 additions & 67 deletions

File tree

‎google/cloud/securitycenter/v1/BUILD.bazel‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
11
# This file was automatically generated by BuildFileGenerator
2+
# https://github.com/googleapis/rules_gapic/tree/master/bazel
3+
4+
# Most of the manual changes to this file will be overwritten.
5+
# It's **only** allowed to change the following rule attribute values:
6+
# - names of *_gapic_assembly_* rules
7+
# - certain parameters of *_gapic_library rules, including but not limited to:
8+
# * extra_protoc_parameters
9+
# * extra_protoc_file_parameters
10+
# The complete list of preserved parameters can be found in the source code.
211

312
# This is an API workspace, having public visibility by default makes perfect sense.
413
package(default_visibility = ["//visibility:public"])
@@ -15,6 +24,7 @@ proto_library(
1524
"asset.proto",
1625
"finding.proto",
1726
"folder.proto",
27+
"indicator.proto",
1828
"notification_config.proto",
1929
"notification_message.proto",
2030
"organization_settings.proto",
@@ -132,6 +142,7 @@ go_gapic_library(
132142
srcs = [":securitycenter_proto_with_info"],
133143
grpc_service_config = "securitycenter_grpc_service_config.json",
134144
importpath = "cloud.google.com/go/securitycenter/apiv1;securitycenter",
145+
metadata = True,
135146
service_yaml = "securitycenter_v1.yaml",
136147
deps = [
137148
":securitycenter_go_proto",
@@ -156,6 +167,7 @@ go_gapic_assembly_pkg(
156167
name = "gapi-cloud-securitycenter-v1-go",
157168
deps = [
158169
":securitycenter_go_gapic",
170+
":securitycenter_go_gapic_srcjar-metadata.srcjar",
159171
":securitycenter_go_gapic_srcjar-test.srcjar",
160172
":securitycenter_go_proto",
161173
],
@@ -281,11 +293,11 @@ ruby_cloud_gapic_library(
281293
name = "securitycenter_ruby_gapic",
282294
srcs = [":securitycenter_proto_with_info"],
283295
extra_protoc_parameters = [
284-
"ruby-cloud-gem-name=google-cloud-security_center-v1",
285-
"ruby-cloud-env-prefix=SECURITY_CENTER",
286-
"ruby-cloud-product-url=https://cloud.google.com/security-command-center",
287296
"ruby-cloud-api-id=securitycenter.googleapis.com",
288297
"ruby-cloud-api-shortname=securitycenter",
298+
"ruby-cloud-env-prefix=SECURITY_CENTER",
299+
"ruby-cloud-gem-name=google-cloud-security_center-v1",
300+
"ruby-cloud-product-url=https://cloud.google.com/security-command-center",
289301
],
290302
grpc_service_config = "securitycenter_grpc_service_config.json",
291303
ruby_cloud_description = "Security Command Center API provides access to temporal views of assets and findings within an organization.",
@@ -348,3 +360,8 @@ csharp_gapic_assembly_pkg(
348360
":securitycenter_csharp_proto",
349361
],
350362
)
363+
364+
##############################################################################
365+
# C++
366+
##############################################################################
367+
# Put your C++ rules here

‎google/cloud/securitycenter/v1/finding.proto‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package google.cloud.securitycenter.v1;
1818

1919
import "google/api/field_behavior.proto";
2020
import "google/api/resource.proto";
21+
import "google/cloud/securitycenter/v1/indicator.proto";
2122
import "google/cloud/securitycenter/v1/security_marks.proto";
2223
import "google/protobuf/struct.proto";
2324
import "google/protobuf/timestamp.proto";
@@ -117,6 +118,26 @@ message Finding {
117118
LOW = 4;
118119
}
119120

121+
// Represents what kind of Finding it is.
122+
enum FindingClass {
123+
// Unspecified finding class.
124+
FINDING_CLASS_UNSPECIFIED = 0;
125+
126+
// Describes unwanted or malicious activity.
127+
THREAT = 1;
128+
129+
// Describes a potential weakness in software that increases risk to
130+
// Confidentiality & Integrity & Availability.
131+
VULNERABILITY = 2;
132+
133+
// Describes a potential weakness in cloud resource/asset configuration that
134+
// increases risk.
135+
MISCONFIGURATION = 3;
136+
137+
// Describes a security observation that is for informational purposes.
138+
OBSERVATION = 4;
139+
}
140+
120141
// The relative resource name of this finding. See:
121142
// https://cloud.google.com/apis/design/resource_names#relative_resource_name
122143
// Example:
@@ -184,4 +205,14 @@ message Finding {
184205
// depending on the closest CRM ancestor of the resource associated with the
185206
// finding.
186207
string canonical_name = 14;
208+
209+
// The class of the finding.
210+
FindingClass finding_class = 17;
211+
212+
// Represents what's commonly known as an Indicator of compromise (IoC) in
213+
// computer forensics. This is an artifact observed on a network or in an
214+
// operating system that, with high confidence, indicates a computer
215+
// intrusion.
216+
// Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
217+
Indicator indicator = 18;
187218
}

‎google/cloud/securitycenter/v1/indicator.proto‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Copyright 2021 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/api/annotations.proto";
20+
21+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
22+
option java_multiple_files = true;
23+
option java_outer_classname = "IndicatorProto";
24+
option java_package = "com.google.cloud.securitycenter.v1";
25+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
26+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
27+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
28+
29+
30+
// Represents what's commonly known as an Indicator of compromise (IoC) in
31+
// computer forensics. This is an artifact observed on a network or in an
32+
// operating system that, with high confidence, indicates a computer intrusion.
33+
// Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
34+
message Indicator {
35+
// List of ip addresses associated to the Finding.
36+
repeated string ip_addresses = 1;
37+
38+
// List of domains associated to the Finding.
39+
repeated string domains = 2;
40+
}

0 commit comments

Comments
 (0)