Skip to content

Commit a7a3440

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Added vulnerability field to the finding
feat: Added type field to the resource which is surfaced in NotificationMessage PiperOrigin-RevId: 401787368
1 parent 94f7778 commit a7a3440

4 files changed

Lines changed: 225 additions & 0 deletions

File tree

‎google/cloud/securitycenter/v1/BUILD.bazel‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ proto_library(
3333
"security_marks.proto",
3434
"securitycenter_service.proto",
3535
"source.proto",
36+
"vulnerability.proto",
3637
],
3738
deps = [
3839
"//google/api:annotations_proto",

‎google/cloud/securitycenter/v1/finding.proto‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import "google/api/field_behavior.proto";
2020
import "google/api/resource.proto";
2121
import "google/cloud/securitycenter/v1/indicator.proto";
2222
import "google/cloud/securitycenter/v1/security_marks.proto";
23+
import "google/cloud/securitycenter/v1/vulnerability.proto";
2324
import "google/protobuf/struct.proto";
2425
import "google/protobuf/timestamp.proto";
2526
import "google/api/annotations.proto";
@@ -215,4 +216,9 @@ message Finding {
215216
// intrusion.
216217
// Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
217218
Indicator indicator = 18;
219+
220+
// Represents vulnerability specific fields like cve, cvss scores etc.
221+
// CVE stands for Common Vulnerabilities and Exposures
222+
// (https://cve.mitre.org/about/)
223+
Vulnerability vulnerability = 20;
218224
}

‎google/cloud/securitycenter/v1/resource.proto‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@ message Resource {
4646
// The human readable name of resource's parent.
4747
string parent_display_name = 5;
4848

49+
// The full resource type of the resource.
50+
string type = 6;
51+
4952
// Output only. Contains a Folder message for each folder in the assets ancestry.
5053
// The first folder is the deepest nested folder, and the last folder is the
5154
// folder directly under the Organization.

‎google/cloud/securitycenter/v1/vulnerability.proto‎

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
// Copyright 2021 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/api/annotations.proto";
20+
21+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
22+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
23+
option java_multiple_files = true;
24+
option java_outer_classname = "VulnerabilityProto";
25+
option java_package = "com.google.cloud.securitycenter.v1";
26+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
27+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
28+
29+
// Refers to common vulnerability fields e.g. cve, cvss, cwe etc.
30+
message Vulnerability {
31+
// CVE stands for Common Vulnerabilities and Exposures
32+
// (https://cve.mitre.org/about/)
33+
Cve cve = 1;
34+
}
35+
36+
// CVE stands for Common Vulnerabilities and Exposures.
37+
// More information: https://cve.mitre.org
38+
message Cve {
39+
// The unique identifier for the vulnerability. e.g. CVE-2021-34527
40+
string id = 1;
41+
42+
// Additional information about the CVE.
43+
// e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
44+
repeated Reference references = 2;
45+
46+
// Describe Common Vulnerability Scoring System specified at
47+
// https://www.first.org/cvss/v3.1/specification-document
48+
Cvssv3 cvssv3 = 3;
49+
}
50+
51+
// Additional Links
52+
message Reference {
53+
// Source of the reference e.g. NVD
54+
string source = 1;
55+
56+
// Uri for the mentioned source e.g.
57+
// https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.
58+
string uri = 2;
59+
}
60+
61+
// Common Vulnerability Scoring System version 3.
62+
message Cvssv3 {
63+
// This metric reflects the context by which vulnerability exploitation is
64+
// possible.
65+
enum AttackVector {
66+
// Invalid value.
67+
ATTACK_VECTOR_UNSPECIFIED = 0;
68+
69+
// The vulnerable component is bound to the network stack and the set of
70+
// possible attackers extends beyond the other options listed below, up to
71+
// and including the entire Internet.
72+
ATTACK_VECTOR_NETWORK = 1;
73+
74+
// The vulnerable component is bound to the network stack, but the attack is
75+
// limited at the protocol level to a logically adjacent topology.
76+
ATTACK_VECTOR_ADJACENT = 2;
77+
78+
// The vulnerable component is not bound to the network stack and the
79+
// attacker's path is via read/write/execute capabilities.
80+
ATTACK_VECTOR_LOCAL = 3;
81+
82+
// The attack requires the attacker to physically touch or manipulate the
83+
// vulnerable component.
84+
ATTACK_VECTOR_PHYSICAL = 4;
85+
}
86+
87+
// This metric describes the conditions beyond the attacker's control that
88+
// must exist in order to exploit the vulnerability.
89+
enum AttackComplexity {
90+
// Invalid value.
91+
ATTACK_COMPLEXITY_UNSPECIFIED = 0;
92+
93+
// Specialized access conditions or extenuating circumstances do not exist.
94+
// An attacker can expect repeatable success when attacking the vulnerable
95+
// component.
96+
ATTACK_COMPLEXITY_LOW = 1;
97+
98+
// A successful attack depends on conditions beyond the attacker's control.
99+
// That is, a successful attack cannot be accomplished at will, but requires
100+
// the attacker to invest in some measurable amount of effort in preparation
101+
// or execution against the vulnerable component before a successful attack
102+
// can be expected.
103+
ATTACK_COMPLEXITY_HIGH = 2;
104+
}
105+
106+
// This metric describes the level of privileges an attacker must possess
107+
// before successfully exploiting the vulnerability.
108+
enum PrivilegesRequired {
109+
// Invalid value.
110+
PRIVILEGES_REQUIRED_UNSPECIFIED = 0;
111+
112+
// The attacker is unauthorized prior to attack, and therefore does not
113+
// require any access to settings or files of the vulnerable system to
114+
// carry out an attack.
115+
PRIVILEGES_REQUIRED_NONE = 1;
116+
117+
// The attacker requires privileges that provide basic user capabilities
118+
// that could normally affect only settings and files owned by a user.
119+
// Alternatively, an attacker with Low privileges has the ability to access
120+
// only non-sensitive resources.
121+
PRIVILEGES_REQUIRED_LOW = 2;
122+
123+
// The attacker requires privileges that provide significant (e.g.,
124+
// administrative) control over the vulnerable component allowing access to
125+
// component-wide settings and files.
126+
PRIVILEGES_REQUIRED_HIGH = 3;
127+
}
128+
129+
// This metric captures the requirement for a human user, other than the
130+
// attacker, to participate in the successful compromise of the vulnerable
131+
// component.
132+
enum UserInteraction {
133+
// Invalid value.
134+
USER_INTERACTION_UNSPECIFIED = 0;
135+
136+
// The vulnerable system can be exploited without interaction from any user.
137+
USER_INTERACTION_NONE = 1;
138+
139+
// Successful exploitation of this vulnerability requires a user to take
140+
// some action before the vulnerability can be exploited.
141+
USER_INTERACTION_REQUIRED = 2;
142+
}
143+
144+
// The Scope metric captures whether a vulnerability in one vulnerable
145+
// component impacts resources in components beyond its security scope.
146+
enum Scope {
147+
// Invalid value.
148+
SCOPE_UNSPECIFIED = 0;
149+
150+
// An exploited vulnerability can only affect resources managed by the same
151+
// security authority.
152+
SCOPE_UNCHANGED = 1;
153+
154+
// An exploited vulnerability can affect resources beyond the security scope
155+
// managed by the security authority of the vulnerable component.
156+
SCOPE_CHANGED = 2;
157+
}
158+
159+
// The Impact metrics capture the effects of a successfully exploited
160+
// vulnerability on the component that suffers the worst outcome that is most
161+
// directly and predictably associated with the attack.
162+
enum Impact {
163+
// Invalid value.
164+
IMPACT_UNSPECIFIED = 0;
165+
166+
// High impact.
167+
IMPACT_HIGH = 1;
168+
169+
// Low impact.
170+
IMPACT_LOW = 2;
171+
172+
// No impact.
173+
IMPACT_NONE = 3;
174+
}
175+
176+
// The base score is a function of the base metric scores.
177+
double base_score = 1;
178+
179+
// Base Metrics
180+
// Represents the intrinsic characteristics of a vulnerability that are
181+
// constant over time and across user environments.
182+
// This metric reflects the context by which vulnerability exploitation is
183+
// possible.
184+
AttackVector attack_vector = 5;
185+
186+
// This metric describes the conditions beyond the attacker's control that
187+
// must exist in order to exploit the vulnerability.
188+
AttackComplexity attack_complexity = 6;
189+
190+
// This metric describes the level of privileges an attacker must possess
191+
// before successfully exploiting the vulnerability.
192+
PrivilegesRequired privileges_required = 7;
193+
194+
// This metric captures the requirement for a human user, other than the
195+
// attacker, to participate in the successful compromise of the vulnerable
196+
// component.
197+
UserInteraction user_interaction = 8;
198+
199+
// The Scope metric captures whether a vulnerability in one vulnerable
200+
// component impacts resources in components beyond its security scope.
201+
Scope scope = 9;
202+
203+
// This metric measures the impact to the confidentiality of the information
204+
// resources managed by a software component due to a successfully exploited
205+
// vulnerability.
206+
Impact confidentiality_impact = 10;
207+
208+
// This metric measures the impact to integrity of a successfully exploited
209+
// vulnerability.
210+
Impact integrity_impact = 11;
211+
212+
// This metric measures the impact to the availability of the impacted
213+
// component resulting from a successfully exploited vulnerability.
214+
Impact availability_impact = 12;
215+
}

0 commit comments

Comments
 (0)