Skip to content

Commit 5bfadd9

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Add compliances, processes and exfiltration fields to findings attributes. They contain compliance information about a security standard indicating unmet recommendations, represents operating system processes, and data exfiltration attempt of one or more source(s) to one or more target(s). Source(s) represent the source of data that is exfiltrated, and Target(s) represents the destination the data was copied to
PiperOrigin-RevId: 452067806
1 parent a2df6aa commit 5bfadd9

8 files changed

Lines changed: 240 additions & 5 deletions

File tree

‎google/cloud/securitycenter/v1/BUILD.bazel‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,11 @@ proto_library(
5454
"access.proto",
5555
"asset.proto",
5656
"bigquery_export.proto",
57+
"compliance.proto",
5758
"connection.proto",
59+
"exfiltration.proto",
5860
"external_system.proto",
61+
"file.proto",
5962
"finding.proto",
6063
"folder.proto",
6164
"iam_binding.proto",
@@ -65,6 +68,7 @@ proto_library(
6568
"notification_config.proto",
6669
"notification_message.proto",
6770
"organization_settings.proto",
71+
"process.proto",
6872
"resource.proto",
6973
"run_asset_discovery_response.proto",
7074
"security_marks.proto",

‎google/cloud/securitycenter/v1/compliance.proto‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
20+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
21+
option java_multiple_files = true;
22+
option java_outer_classname = "ComplianceProto";
23+
option java_package = "com.google.cloud.securitycenter.v1";
24+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
25+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
26+
27+
// Contains compliance information about a security standard indicating unmet
28+
// recommendations.
29+
message Compliance {
30+
// Refers to industry wide standards or benchmarks e.g. "cis", "pci", "owasp",
31+
// etc.
32+
string standard = 1;
33+
34+
// Version of the standard/benchmark e.g. 1.1
35+
string version = 2;
36+
37+
// Policies within the standard/benchmark e.g. A.12.4.1
38+
repeated string ids = 3;
39+
}

‎google/cloud/securitycenter/v1/exfiltration.proto‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
20+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
21+
option java_multiple_files = true;
22+
option java_outer_classname = "ExfiltrationProto";
23+
option java_package = "com.google.cloud.securitycenter.v1";
24+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
25+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
26+
27+
// Exfiltration represents a data exfiltration attempt of one or more
28+
// sources to one or more targets. Sources represent the source
29+
// of data that is exfiltrated, and Targets represents the destination the
30+
// data was copied to.
31+
message Exfiltration {
32+
// If there are multiple sources, then the data is considered "joined" between
33+
// them. For instance, BigQuery can join multiple tables, and each
34+
// table would be considered a source.
35+
repeated ExfilResource sources = 1;
36+
37+
// If there are multiple targets, each target would get a complete copy of the
38+
// "joined" source data.
39+
repeated ExfilResource targets = 2;
40+
}
41+
42+
// Resource that has been exfiltrated or exfiltrated_to.
43+
message ExfilResource {
44+
// Resource's URI (https://google.aip.dev/122#full-resource-names)
45+
string name = 1;
46+
47+
// Subcomponents of the asset that is exfiltrated - these could be
48+
// URIs used during exfiltration, table names, databases, filenames, etc.
49+
// For example, multiple tables may be exfiltrated from the same CloudSQL
50+
// instance, or multiple files from the same Cloud Storage bucket.
51+
repeated string components = 2;
52+
}

‎google/cloud/securitycenter/v1/file.proto‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
20+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
21+
option java_multiple_files = true;
22+
option java_outer_classname = "FileProto";
23+
option java_package = "com.google.cloud.securitycenter.v1";
24+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
25+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
26+
27+
// File information about the related binary/library used by an executable, or
28+
// the script used by a script interpreter
29+
message File {
30+
// Absolute path of the file as a JSON encoded string.
31+
string path = 1;
32+
33+
// Size of the file in bytes.
34+
int64 size = 2;
35+
36+
// SHA256 hash of the first hashed_size bytes of the file encoded as a
37+
// hex string. If hashed_size == size, hash_sha256 represents the SHA256 hash
38+
// of the entire file.
39+
string sha256 = 3;
40+
41+
// The length in bytes of the file prefix that was hashed. If
42+
// hashed_size == size, any hashes reported represent the entire
43+
// file.
44+
int64 hashed_size = 4;
45+
46+
// True when the hash covers only a prefix of the file.
47+
bool partially_hashed = 5;
48+
49+
// Prefix of the file contents as a JSON encoded string.
50+
// (Currently only populated for Malicious Script Executed findings.)
51+
string contents = 6;
52+
}

‎google/cloud/securitycenter/v1/finding.proto‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,14 @@ package google.cloud.securitycenter.v1;
1919
import "google/api/field_behavior.proto";
2020
import "google/api/resource.proto";
2121
import "google/cloud/securitycenter/v1/access.proto";
22+
import "google/cloud/securitycenter/v1/compliance.proto";
2223
import "google/cloud/securitycenter/v1/connection.proto";
24+
import "google/cloud/securitycenter/v1/exfiltration.proto";
2325
import "google/cloud/securitycenter/v1/external_system.proto";
2426
import "google/cloud/securitycenter/v1/iam_binding.proto";
2527
import "google/cloud/securitycenter/v1/indicator.proto";
2628
import "google/cloud/securitycenter/v1/mitre_attack.proto";
29+
import "google/cloud/securitycenter/v1/process.proto";
2730
import "google/cloud/securitycenter/v1/security_marks.proto";
2831
import "google/cloud/securitycenter/v1/vulnerability.proto";
2932
import "google/protobuf/struct.proto";
@@ -251,11 +254,13 @@ message Finding {
251254
Vulnerability vulnerability = 20;
252255

253256
// Output only. The most recent time this finding was muted or unmuted.
254-
google.protobuf.Timestamp mute_update_time = 21 [(google.api.field_behavior) = OUTPUT_ONLY];
257+
google.protobuf.Timestamp mute_update_time = 21
258+
[(google.api.field_behavior) = OUTPUT_ONLY];
255259

256-
// Output only. Third party SIEM/SOAR fields within SCC, contains external system
257-
// information and external system finding fields.
258-
map<string, ExternalSystem> external_systems = 22 [(google.api.field_behavior) = OUTPUT_ONLY];
260+
// Output only. Third party SIEM/SOAR fields within SCC, contains external
261+
// system information and external system finding fields.
262+
map<string, ExternalSystem> external_systems = 22
263+
[(google.api.field_behavior) = OUTPUT_ONLY];
259264

260265
// MITRE ATT&CK tactics and techniques related to this finding.
261266
// See: https://attack.mitre.org
@@ -274,9 +279,19 @@ message Finding {
274279
// shouldn't set the value of mute.
275280
string mute_initiator = 28;
276281

282+
// Represents operating system processes associated with the Finding.
283+
repeated Process processes = 30;
284+
285+
// Contains compliance information for security standards associated to the
286+
// finding.
287+
repeated Compliance compliances = 34;
288+
277289
// Contains more detail about the finding.
278290
string description = 37;
279291

292+
// Represents exfiltration associated with the Finding.
293+
Exfiltration exfiltration = 38;
294+
280295
// Represents IAM bindings associated with the Finding.
281296
repeated IamBinding iam_bindings = 39;
282297

‎google/cloud/securitycenter/v1/mitre_attack.proto‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,6 @@ message MitreAttack {
7878

7979
// MITRE ATT&CK techniques that can be referenced by SCC findings.
8080
// See: https://attack.mitre.org/techniques/enterprise/
81-
// Next ID: 31
8281
enum Technique {
8382
// Unspecified value.
8483
TECHNIQUE_UNSPECIFIED = 0;
@@ -172,6 +171,9 @@ message MitreAttack {
172171

173172
// T1484
174173
DOMAIN_POLICY_MODIFICATION = 30;
174+
175+
// T1562
176+
IMPAIR_DEFENSES = 31;
175177
}
176178

177179
// The MITRE ATT&CK tactic most closely represented by this finding, if any.

‎google/cloud/securitycenter/v1/process.proto‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/cloud/securitycenter/v1/file.proto";
20+
21+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
22+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
23+
option java_multiple_files = true;
24+
option java_outer_classname = "ProcessProto";
25+
option java_package = "com.google.cloud.securitycenter.v1";
26+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
27+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
28+
29+
// Represents an operating system process.
30+
message Process {
31+
// File information for the process executable.
32+
File binary = 3;
33+
34+
// File information for libraries loaded by the process.
35+
repeated File libraries = 4;
36+
37+
// When the process represents the invocation of a script,
38+
// `binary` provides information about the interpreter while `script`
39+
// provides information about the script file provided to the
40+
// interpreter.
41+
File script = 5;
42+
43+
// Process arguments as JSON encoded strings.
44+
repeated string args = 6;
45+
46+
// True if `args` is incomplete.
47+
bool arguments_truncated = 7;
48+
49+
// Process environment variables.
50+
repeated EnvironmentVariable env_variables = 8;
51+
52+
// True if `env_variables` is incomplete.
53+
bool env_variables_truncated = 9;
54+
55+
// The process id.
56+
int64 pid = 10;
57+
58+
// The parent process id.
59+
int64 parent_pid = 11;
60+
}
61+
62+
// EnvironmentVariable is a name-value pair to store environment variables for
63+
// Process.
64+
message EnvironmentVariable {
65+
// Environment variable name as a JSON encoded string.
66+
string name = 1;
67+
68+
// Environment variable value as a JSON encoded string.
69+
string val = 2;
70+
}

‎google/cloud/securitycenter/v1/securitycenter_v1.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ title: Security Command Center API
55

66
apis:
77
- name: google.cloud.securitycenter.v1.SecurityCenter
8+
- name: google.longrunning.Operations
89

910
types:
1011
- name: google.cloud.securitycenter.v1.BigQueryExport

0 commit comments

Comments
 (0)