Skip to content

Commit be8f988

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Added a new API method UpdateExternalSystem, which enables updating a finding w/ external system metadata. External systems are a child resource under finding, and are housed on the finding itself, and can also be filtered on in Notifications, the ListFindings and GroupFindings API
PiperOrigin-RevId: 411093163
1 parent 8ce4ea6 commit be8f988

5 files changed

Lines changed: 95 additions & 0 deletions

File tree

‎google/cloud/securitycenter/v1/BUILD.bazel‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ proto_library(
2222
name = "securitycenter_proto",
2323
srcs = [
2424
"asset.proto",
25+
"external_system.proto",
2526
"finding.proto",
2627
"folder.proto",
2728
"indicator.proto",

‎google/cloud/securitycenter/v1/external_system.proto‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
// Copyright 2021 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/api/resource.proto";
20+
import "google/protobuf/timestamp.proto";
21+
import "google/api/annotations.proto";
22+
23+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
24+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
25+
option java_multiple_files = true;
26+
option java_outer_classname = "ExternalSystemProto";
27+
option java_package = "com.google.cloud.securitycenter.v1";
28+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
29+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
30+
31+
// Representation of third party SIEM/SOAR fields within SCC.
32+
message ExternalSystem {
33+
option (google.api.resource) = {
34+
type: "securitycenter.googleapis.com/ExternalSystem"
35+
pattern: "organizations/{organization}/sources/{source}/findings/{finding}/externalSystems/{externalsystem}"
36+
pattern: "folders/{folder}/sources/{source}/findings/{finding}/externalSystems/{externalsystem}"
37+
pattern: "projects/{project}/sources/{source}/findings/{finding}/externalSystems/{externalsystem}"
38+
};
39+
40+
// External System Name e.g. jira, demisto, etc.
41+
// e.g.: `organizations/1234/sources/5678/findings/123456/externalSystems/jira`
42+
// `folders/1234/sources/5678/findings/123456/externalSystems/jira`
43+
// `projects/1234/sources/5678/findings/123456/externalSystems/jira`
44+
string name = 1;
45+
46+
// References primary/secondary etc assignees in the external system.
47+
repeated string assignees = 2;
48+
49+
// Identifier that's used to track the given finding in the external system.
50+
string external_uid = 3;
51+
52+
// Most recent status of the corresponding finding's ticket/tracker in the
53+
// external system.
54+
string status = 4;
55+
56+
// The most recent time when the corresponding finding's ticket/tracker was
57+
// updated in the external system.
58+
google.protobuf.Timestamp external_system_update_time = 5;
59+
}

‎google/cloud/securitycenter/v1/finding.proto‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package google.cloud.securitycenter.v1;
1818

1919
import "google/api/field_behavior.proto";
2020
import "google/api/resource.proto";
21+
import "google/cloud/securitycenter/v1/external_system.proto";
2122
import "google/cloud/securitycenter/v1/indicator.proto";
2223
import "google/cloud/securitycenter/v1/security_marks.proto";
2324
import "google/cloud/securitycenter/v1/vulnerability.proto";
@@ -244,6 +245,10 @@ message Finding {
244245
// Output only. The most recent time this finding was muted or unmuted.
245246
google.protobuf.Timestamp mute_update_time = 21 [(google.api.field_behavior) = OUTPUT_ONLY];
246247

248+
// Output only. Third party SIEM/SOAR fields within SCC, contains external system
249+
// information and external system finding fields.
250+
map<string, ExternalSystem> external_systems = 22 [(google.api.field_behavior) = OUTPUT_ONLY];
251+
247252
// First known as mute_annotation. Records additional information about the
248253
// mute operation e.g. mute config that muted the finding, user who muted the
249254
// finding, etc.

‎google/cloud/securitycenter/v1/securitycenter_service.proto‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import "google/api/client.proto";
2222
import "google/api/field_behavior.proto";
2323
import "google/api/resource.proto";
2424
import "google/cloud/securitycenter/v1/asset.proto";
25+
import "google/cloud/securitycenter/v1/external_system.proto";
2526
import "google/cloud/securitycenter/v1/finding.proto";
2627
import "google/cloud/securitycenter/v1/folder.proto";
2728
import "google/cloud/securitycenter/v1/mute_config.proto";
@@ -364,6 +365,23 @@ service SecurityCenter {
364365
option (google.api.method_signature) = "resource,permissions";
365366
}
366367

368+
// Updates external system. This is for a given finding.
369+
rpc UpdateExternalSystem(UpdateExternalSystemRequest) returns (ExternalSystem) {
370+
option (google.api.http) = {
371+
patch: "/v1/{external_system.name=organizations/*/sources/*/findings/*/externalSystems/*}"
372+
body: "external_system"
373+
additional_bindings {
374+
patch: "/v1/{external_system.name=folders/*/sources/*/findings/*/externalSystems/*}"
375+
body: "external_system"
376+
}
377+
additional_bindings {
378+
patch: "/v1/{external_system.name=projects/*/sources/*/findings/*/externalSystems/*}"
379+
body: "external_system"
380+
}
381+
};
382+
option (google.api.method_signature) = "external_system,update_mask";
383+
}
384+
367385
// Creates or updates a finding. The corresponding source must exist for a
368386
// finding creation to succeed.
369387
rpc UpdateFinding(UpdateFindingRequest) returns (Finding) {
@@ -1575,6 +1593,17 @@ message RunAssetDiscoveryRequest {
15751593
];
15761594
}
15771595

1596+
// Request message for updating a ExternalSystem resource.
1597+
message UpdateExternalSystemRequest {
1598+
// Required. The external system resource to update.
1599+
ExternalSystem external_system = 1 [(google.api.field_behavior) = REQUIRED];
1600+
1601+
// The FieldMask to use when updating the external system resource.
1602+
//
1603+
// If empty all mutable fields will be updated.
1604+
google.protobuf.FieldMask update_mask = 2;
1605+
}
1606+
15781607
// Request message for updating or creating a finding.
15791608
message UpdateFindingRequest {
15801609
// Required. The finding resource to update or create if it does not already exist.

‎google/cloud/securitycenter/v1/securitycenter_v1.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ apis:
88

99
types:
1010
- name: google.cloud.securitycenter.v1.BulkMuteFindingsResponse
11+
- name: google.cloud.securitycenter.v1.ExternalSystem
1112
- name: google.cloud.securitycenter.v1.MuteConfig
1213
- name: google.cloud.securitycenter.v1.NotificationMessage
1314
- name: google.cloud.securitycenter.v1.Resource

0 commit comments

Comments
 (0)