Skip to content

Commit 7fdec62

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Added contacts field to findings attributes, specifying Essential Contacts defined at org, folder or project level within a GCP org
feat: Added process signature fields to the indicator attribute that helps surface multiple types of signature defined IOCs PiperOrigin-RevId: 458537238
1 parent 1d3a23b commit 7fdec62

6 files changed

Lines changed: 109 additions & 7 deletions

File tree

‎google/cloud/securitycenter/v1/BUILD.bazel‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ proto_library(
5656
"bigquery_export.proto",
5757
"compliance.proto",
5858
"connection.proto",
59+
"contact_details.proto",
5960
"exfiltration.proto",
6061
"external_system.proto",
6162
"file.proto",

‎google/cloud/securitycenter/v1/contact_details.proto‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
20+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
21+
option java_multiple_files = true;
22+
option java_outer_classname = "ContactDetailsProto";
23+
option java_package = "com.google.cloud.securitycenter.v1";
24+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
25+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
26+
27+
// The details pertaining to specific contacts
28+
message ContactDetails {
29+
// A list of contacts
30+
repeated Contact contacts = 1;
31+
}
32+
33+
// Representa a single contact's email address
34+
message Contact {
35+
// An email address e.g. "[email protected]"
36+
string email = 1;
37+
}

‎google/cloud/securitycenter/v1/file.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ message File {
3434
int64 size = 2;
3535

3636
// SHA256 hash of the first hashed_size bytes of the file encoded as a
37-
// hex string. If hashed_size == size, hash_sha256 represents the SHA256 hash
37+
// hex string. If hashed_size == size, sha256 represents the SHA256 hash
3838
// of the entire file.
3939
string sha256 = 3;
4040

‎google/cloud/securitycenter/v1/finding.proto‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import "google/api/resource.proto";
2121
import "google/cloud/securitycenter/v1/access.proto";
2222
import "google/cloud/securitycenter/v1/compliance.proto";
2323
import "google/cloud/securitycenter/v1/connection.proto";
24+
import "google/cloud/securitycenter/v1/contact_details.proto";
2425
import "google/cloud/securitycenter/v1/exfiltration.proto";
2526
import "google/cloud/securitycenter/v1/external_system.proto";
2627
import "google/cloud/securitycenter/v1/iam_binding.proto";
@@ -254,13 +255,11 @@ message Finding {
254255
Vulnerability vulnerability = 20;
255256

256257
// Output only. The most recent time this finding was muted or unmuted.
257-
google.protobuf.Timestamp mute_update_time = 21
258-
[(google.api.field_behavior) = OUTPUT_ONLY];
258+
google.protobuf.Timestamp mute_update_time = 21 [(google.api.field_behavior) = OUTPUT_ONLY];
259259

260-
// Output only. Third party SIEM/SOAR fields within SCC, contains external
261-
// system information and external system finding fields.
262-
map<string, ExternalSystem> external_systems = 22
263-
[(google.api.field_behavior) = OUTPUT_ONLY];
260+
// Output only. Third party SIEM/SOAR fields within SCC, contains external system
261+
// information and external system finding fields.
262+
map<string, ExternalSystem> external_systems = 22 [(google.api.field_behavior) = OUTPUT_ONLY];
264263

265264
// MITRE ATT&CK tactics and techniques related to this finding.
266265
// See: https://attack.mitre.org
@@ -282,6 +281,25 @@ message Finding {
282281
// Represents operating system processes associated with the Finding.
283282
repeated Process processes = 30;
284283

284+
// Output only. Map containing the point of contacts for the given finding. The key
285+
// represents the type of contact, while the value contains a list of all the
286+
// contacts that pertain. Please refer to:
287+
// https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories
288+
//
289+
// {
290+
// "security": {
291+
// "contacts": [
292+
// {
293+
// "email": "[email protected]"
294+
// },
295+
// {
296+
// "email": "[email protected]"
297+
// }
298+
// ]
299+
// }
300+
// }
301+
map<string, ContactDetails> contacts = 33 [(google.api.field_behavior) = OUTPUT_ONLY];
302+
285303
// Contains compliance information for security standards associated to the
286304
// finding.
287305
repeated Compliance compliances = 34;

‎google/cloud/securitycenter/v1/indicator.proto‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,51 @@ option ruby_package = "Google::Cloud::SecurityCenter::V1";
2929
// operating system that, with high confidence, indicates a computer intrusion.
3030
// Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
3131
message Indicator {
32+
// Indicates what signature matched this process.
33+
message ProcessSignature {
34+
// A signature corresponding to memory page hashes.
35+
message MemoryHashSignature {
36+
// Memory hash detection contributing to the binary family match.
37+
message Detection {
38+
// The name of the binary associated with the memory hash
39+
// signature detection.
40+
string binary = 2;
41+
42+
// The percentage of memory page hashes in the signature
43+
// that were matched.
44+
double percent_pages_matched = 3;
45+
}
46+
47+
// The binary family.
48+
string binary_family = 1;
49+
50+
// The list of memory hash detections contributing to the binary family
51+
// match.
52+
repeated Detection detections = 4;
53+
}
54+
55+
// A signature corresponding to a YARA rule.
56+
message YaraRuleSignature {
57+
// The name of the YARA rule.
58+
string yara_rule = 5;
59+
}
60+
61+
oneof signature {
62+
// Signature indicating that a binary family was matched.
63+
MemoryHashSignature memory_hash_signature = 6;
64+
65+
// Signature indicating that a YARA rule was matched.
66+
YaraRuleSignature yara_rule_signature = 7;
67+
}
68+
}
69+
3270
// List of ip addresses associated to the Finding.
3371
repeated string ip_addresses = 1;
3472

3573
// List of domains associated to the Finding.
3674
repeated string domains = 2;
75+
76+
// The list of matched signatures indicating that the given
77+
// process is present in the environment.
78+
repeated ProcessSignature signatures = 3;
3779
}

‎google/cloud/securitycenter/v1/process.proto‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ option ruby_package = "Google::Cloud::SecurityCenter::V1";
2828

2929
// Represents an operating system process.
3030
message Process {
31+
// The process name visible in utilities like `top` and `ps`; it can
32+
// be accessed via `/proc/[pid]/comm` and changed with `prctl(PR_SET_NAME)`.
33+
string name = 12;
34+
3135
// File information for the process executable.
3236
File binary = 3;
3337

0 commit comments

Comments
 (0)