Skip to content

Commit d2c86cf

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Add load balancer, log entry, org policy, database.version, exfiltration.total_exfiltrated_bytes, file.disk_path, indicator.signature_type, and kubernetes.objects to finding's list of attributes
PiperOrigin-RevId: 609614842
1 parent 4e6304c commit d2c86cf

12 files changed

Lines changed: 337 additions & 60 deletions

‎google/cloud/securitycenter/v1/BUILD.bazel‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,11 +44,14 @@ proto_library(
4444
"kernel_rootkit.proto",
4545
"kubernetes.proto",
4646
"label.proto",
47+
"load_balancer.proto",
48+
"log_entry.proto",
4749
"mitre_attack.proto",
4850
"mute_config.proto",
4951
"notification_config.proto",
5052
"notification_message.proto",
5153
"organization_settings.proto",
54+
"org_policy.proto",
5255
"process.proto",
5356
"resource.proto",
5457
"run_asset_discovery_response.proto",

‎google/cloud/securitycenter/v1/database.proto‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,12 @@ option ruby_package = "Google::Cloud::SecurityCenter::V1";
3131
// name](https://google.aip.dev/122#full-resource-names) populated because these
3232
// resource types, such as Cloud SQL databases, are not yet supported by Cloud
3333
// Asset Inventory. In these cases only the display name is provided.
34-
// Some database resources may not have the [full resource
35-
// name](https://google.aip.dev/122#full-resource-names) populated because
36-
// these resource types are not yet supported by Cloud Asset Inventory (e.g.
37-
// Cloud SQL databases). In these cases only the display name will be
38-
// provided.
3934
message Database {
35+
// Some database resources may not have the [full resource
36+
// name](https://google.aip.dev/122#full-resource-names) populated because
37+
// these resource types are not yet supported by Cloud Asset Inventory (e.g.
38+
// Cloud SQL databases). In these cases only the display name will be
39+
// provided.
4040
// The [full resource name](https://google.aip.dev/122#full-resource-names) of
4141
// the database that the user connected to, if it is supported by Cloud Asset
4242
// Inventory.
@@ -55,4 +55,9 @@ message Database {
5555
// The target usernames, roles, or groups of an SQL privilege grant, which is
5656
// not an IAM policy change.
5757
repeated string grantees = 5;
58+
59+
// The version of the database, for example, POSTGRES_14.
60+
// See [the complete
61+
// list](https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1/SqlDatabaseVersion).
62+
string version = 6;
5863
}

‎google/cloud/securitycenter/v1/exfiltration.proto‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@ message Exfiltration {
3737
// If there are multiple targets, each target would get a complete copy of the
3838
// "joined" source data.
3939
repeated ExfilResource targets = 2;
40+
41+
// Total exfiltrated bytes processed for the entire job.
42+
int64 total_exfiltrated_bytes = 3;
4043
}
4144

4245
// Resource where data was exfiltrated from or exfiltrated to.

‎google/cloud/securitycenter/v1/file.proto‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,17 @@ option ruby_package = "Google::Cloud::SecurityCenter::V1";
2727
// File information about the related binary/library used by an executable, or
2828
// the script used by a script interpreter
2929
message File {
30+
// Path of the file in terms of underlying disk/partition identifiers.
31+
message DiskPath {
32+
// UUID of the partition (format
33+
// https://wiki.archlinux.org/title/persistent_block_device_naming#by-uuid)
34+
string partition_uuid = 1;
35+
36+
// Relative path of the file in the partition as a JSON encoded string.
37+
// Example: /home/user1/executable_file.sh
38+
string relative_path = 2;
39+
}
40+
3041
// Absolute path of the file as a JSON encoded string.
3142
string path = 1;
3243

@@ -48,4 +59,7 @@ message File {
4859

4960
// Prefix of the file contents as a JSON-encoded string.
5061
string contents = 6;
62+
63+
// Path of the file in terms of underlying disk/partition identifiers.
64+
DiskPath disk_path = 7;
5165
}

‎google/cloud/securitycenter/v1/finding.proto‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,10 @@ import "google/cloud/securitycenter/v1/iam_binding.proto";
3535
import "google/cloud/securitycenter/v1/indicator.proto";
3636
import "google/cloud/securitycenter/v1/kernel_rootkit.proto";
3737
import "google/cloud/securitycenter/v1/kubernetes.proto";
38+
import "google/cloud/securitycenter/v1/load_balancer.proto";
39+
import "google/cloud/securitycenter/v1/log_entry.proto";
3840
import "google/cloud/securitycenter/v1/mitre_attack.proto";
41+
import "google/cloud/securitycenter/v1/org_policy.proto";
3942
import "google/cloud/securitycenter/v1/process.proto";
4043
import "google/cloud/securitycenter/v1/security_marks.proto";
4144
import "google/cloud/securitycenter/v1/vulnerability.proto";
@@ -362,9 +365,18 @@ message Finding {
362365
// Signature of the kernel rootkit.
363366
KernelRootkit kernel_rootkit = 50;
364367

368+
// Contains information about the org policies associated with the finding.
369+
repeated OrgPolicy org_policies = 51;
370+
365371
// Represents an application associated with the finding.
366372
Application application = 53;
367373

368374
// Fields related to Backup and DR findings.
369375
BackupDisasterRecovery backup_disaster_recovery = 55;
376+
377+
// Log entries that are relevant to the finding.
378+
repeated LogEntry log_entries = 57;
379+
380+
// The load balancers associated with the finding.
381+
repeated LoadBalancer load_balancers = 58;
370382
}

‎google/cloud/securitycenter/v1/indicator.proto‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,13 +59,28 @@ message Indicator {
5959
string yara_rule = 5;
6060
}
6161

62+
// Possible resource types to be associated with a signature.
63+
enum SignatureType {
64+
// The default signature type.
65+
SIGNATURE_TYPE_UNSPECIFIED = 0;
66+
67+
// Used for signatures concerning processes.
68+
SIGNATURE_TYPE_PROCESS = 1;
69+
70+
// Used for signatures concerning disks.
71+
SIGNATURE_TYPE_FILE = 2;
72+
}
73+
6274
oneof signature {
6375
// Signature indicating that a binary family was matched.
6476
MemoryHashSignature memory_hash_signature = 6;
6577

6678
// Signature indicating that a YARA rule was matched.
6779
YaraRuleSignature yara_rule_signature = 7;
6880
}
81+
82+
// Describes the type of resource associated with the signature.
83+
SignatureType signature_type = 8;
6984
}
7085

7186
// The list of IP addresses that are associated with the finding.

‎google/cloud/securitycenter/v1/kubernetes.proto‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,29 @@ message Kubernetes {
158158
string version = 7;
159159
}
160160

161+
// Kubernetes object related to the finding, uniquely identified by GKNN.
162+
// Used if the object Kind is not one of Pod, Node, NodePool, Binding, or
163+
// AccessReview.
164+
message Object {
165+
// Kubernetes object group, such as "policy.k8s.io/v1".
166+
string group = 1;
167+
168+
// Kubernetes object kind, such as "Namespace".
169+
string kind = 2;
170+
171+
// Kubernetes object namespace. Must be a valid DNS label. Named
172+
// "ns" to avoid collision with C++ namespace keyword. For details see
173+
// https://kubernetes.io/docs/tasks/administer-cluster/namespaces/.
174+
string ns = 3;
175+
176+
// Kubernetes object name. For details see
177+
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/.
178+
string name = 4;
179+
180+
// Pod containers associated with this finding, if any.
181+
repeated Container containers = 5;
182+
}
183+
161184
// Kubernetes
162185
// [Pods](https://cloud.google.com/kubernetes-engine/docs/concepts/pod)
163186
// associated with the finding. This field contains Pod records for each
@@ -187,4 +210,7 @@ message Kubernetes {
187210
// Provides information on any Kubernetes access reviews (privilege checks)
188211
// relevant to the finding.
189212
repeated AccessReview access_reviews = 6;
213+
214+
// Kubernetes objects related to the finding.
215+
repeated Object objects = 7;
190216
}

‎google/cloud/securitycenter/v1/load_balancer.proto‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
// Copyright 2024 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
20+
option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
21+
option java_multiple_files = true;
22+
option java_outer_classname = "LoadBalancerProto";
23+
option java_package = "com.google.cloud.securitycenter.v1";
24+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
25+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
26+
27+
// Contains information related to the load balancer associated with the
28+
// finding.
29+
message LoadBalancer {
30+
// The name of the load balancer associated with the finding.
31+
string name = 1;
32+
}

‎google/cloud/securitycenter/v1/log_entry.proto‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
// Copyright 2024 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/protobuf/timestamp.proto";
20+
21+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
22+
option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
23+
option java_multiple_files = true;
24+
option java_outer_classname = "LogEntryProto";
25+
option java_package = "com.google.cloud.securitycenter.v1";
26+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
27+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
28+
29+
// An individual entry in a log.
30+
message LogEntry {
31+
oneof log_entry {
32+
// An individual entry in a log stored in Cloud Logging.
33+
CloudLoggingEntry cloud_logging_entry = 1;
34+
}
35+
}
36+
37+
// Metadata taken from a [Cloud Logging
38+
// LogEntry](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry)
39+
message CloudLoggingEntry {
40+
// A unique identifier for the log entry.
41+
string insert_id = 1;
42+
43+
// The type of the log (part of `log_name`. `log_name` is the resource name of
44+
// the log to which this log entry belongs). For example:
45+
// `cloudresourcemanager.googleapis.com/activity`. Note that this field is not
46+
// URL-encoded, unlike the `LOG_ID` field in `LogEntry`.
47+
string log_id = 2;
48+
49+
// The organization, folder, or project of the monitored resource that
50+
// produced this log entry.
51+
string resource_container = 3;
52+
53+
// The time the event described by the log entry occurred.
54+
google.protobuf.Timestamp timestamp = 4;
55+
}

0 commit comments

Comments
 (0)