Skip to content

Commit f83787e

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Add iam_binding field to findings attributes. It represents particular IAM bindings, which captures a member's role addition, removal, or state
PiperOrigin-RevId: 439976914
1 parent fef35d4 commit f83787e

10 files changed

Lines changed: 93 additions & 36 deletions

‎google/cloud/securitycenter/v1/BUILD.bazel‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ proto_library(
5858
"finding.proto",
5959
"folder.proto",
6060
"indicator.proto",
61+
"iam_binding.proto",
6162
"mitre_attack.proto",
6263
"mute_config.proto",
6364
"notification_config.proto",

‎google/cloud/securitycenter/v1/access.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@ syntax = "proto3";
1616

1717
package google.cloud.securitycenter.v1;
1818

19+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
1920
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
2021
option java_multiple_files = true;
2122
option java_outer_classname = "AccessProto";
2223
option java_package = "com.google.cloud.securitycenter.v1";
23-
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
2424
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
2525
option ruby_package = "Google::Cloud::SecurityCenter::V1";
2626

‎google/cloud/securitycenter/v1/bigquery_export.proto‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -81,21 +81,19 @@ message BigQueryExport {
8181
// Output only. The time at which the big query export was created.
8282
// This field is set by the server and will be ignored if provided on export
8383
// on creation.
84-
google.protobuf.Timestamp create_time = 5
85-
[(google.api.field_behavior) = OUTPUT_ONLY];
84+
google.protobuf.Timestamp create_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
8685

8786
// Output only. The most recent time at which the big export was updated.
8887
// This field is set by the server and will be ignored if provided on export
8988
// creation or update.
90-
google.protobuf.Timestamp update_time = 6
91-
[(google.api.field_behavior) = OUTPUT_ONLY];
89+
google.protobuf.Timestamp update_time = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
9290

93-
// Output only. Email address of the user who last edited the big query
94-
// export. This field is set by the server and will be ignored if provided on
95-
// export creation or update.
91+
// Output only. Email address of the user who last edited the big query export.
92+
// This field is set by the server and will be ignored if provided on export
93+
// creation or update.
9694
string most_recent_editor = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
9795

98-
// Output only. The service account that needs permission to create table,
99-
// upload data to the big query dataset.
96+
// Output only. The service account that needs permission to create table, upload data to
97+
// the big query dataset.
10098
string principal = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
10199
}

‎google/cloud/securitycenter/v1/external_system.proto‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ message ExternalSystem {
3737
};
3838

3939
// External System Name e.g. jira, demisto, etc.
40-
// e.g.: `organizations/1234/sources/5678/findings/123456/externalSystems/jira`
40+
// e.g.:
41+
// `organizations/1234/sources/5678/findings/123456/externalSystems/jira`
4142
// `folders/1234/sources/5678/findings/123456/externalSystems/jira`
4243
// `projects/1234/sources/5678/findings/123456/externalSystems/jira`
4344
string name = 1;

‎google/cloud/securitycenter/v1/finding.proto‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import "google/api/field_behavior.proto";
2020
import "google/api/resource.proto";
2121
import "google/cloud/securitycenter/v1/access.proto";
2222
import "google/cloud/securitycenter/v1/external_system.proto";
23+
import "google/cloud/securitycenter/v1/iam_binding.proto";
2324
import "google/cloud/securitycenter/v1/indicator.proto";
2425
import "google/cloud/securitycenter/v1/mitre_attack.proto";
2526
import "google/cloud/securitycenter/v1/security_marks.proto";
@@ -110,7 +111,7 @@ message Finding {
110111
MEDIUM = 3;
111112

112113
// Vulnerability:
113-
// A low risk vulnerability hampers a security organization’s ability to
114+
// A low risk vulnerability hampers a security organization's ability to
114115
// detect vulnerabilities or active threats in their deployment, or prevents
115116
// the root cause investigation of security issues. An example is monitoring
116117
// and logs being disabled for resource configurations and access.
@@ -228,7 +229,7 @@ message Finding {
228229
// finding.
229230
string canonical_name = 14;
230231

231-
// Indicates the mute state of a finding (either unspecified, muted, unmuted
232+
// Indicates the mute state of a finding (either muted, unmuted
232233
// or undefined). Unlike other attributes of a finding, a finding provider
233234
// shouldn't set the value of mute.
234235
Mute mute = 15;
@@ -249,13 +250,11 @@ message Finding {
249250
Vulnerability vulnerability = 20;
250251

251252
// Output only. The most recent time this finding was muted or unmuted.
252-
google.protobuf.Timestamp mute_update_time = 21
253-
[(google.api.field_behavior) = OUTPUT_ONLY];
253+
google.protobuf.Timestamp mute_update_time = 21 [(google.api.field_behavior) = OUTPUT_ONLY];
254254

255-
// Output only. Third party SIEM/SOAR fields within SCC, contains external
256-
// system information and external system finding fields.
257-
map<string, ExternalSystem> external_systems = 22
258-
[(google.api.field_behavior) = OUTPUT_ONLY];
255+
// Output only. Third party SIEM/SOAR fields within SCC, contains external system
256+
// information and external system finding fields.
257+
map<string, ExternalSystem> external_systems = 22 [(google.api.field_behavior) = OUTPUT_ONLY];
259258

260259
// MITRE ATT&CK tactics and techniques related to this finding.
261260
// See: https://attack.mitre.org
@@ -270,4 +269,7 @@ message Finding {
270269
// finding, etc. Unlike other attributes of a finding, a finding provider
271270
// shouldn't set the value of mute.
272271
string mute_initiator = 28;
272+
273+
// Represents IAM bindings associated with the Finding.
274+
repeated IamBinding iam_bindings = 39;
273275
}

‎google/cloud/securitycenter/v1/iam_binding.proto‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
20+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
21+
option java_multiple_files = true;
22+
option java_outer_classname = "IamBindingProto";
23+
option java_package = "com.google.cloud.securitycenter.v1";
24+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
25+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
26+
27+
// Represents a particular IAM binding, which captures a member's role addition,
28+
// removal, or state.
29+
message IamBinding {
30+
// The type of action performed on a Binding in a policy.
31+
enum Action {
32+
// Unspecified.
33+
ACTION_UNSPECIFIED = 0;
34+
35+
// Addition of a Binding.
36+
ADD = 1;
37+
38+
// Removal of a Binding.
39+
REMOVE = 2;
40+
}
41+
42+
// The action that was performed on a Binding.
43+
Action action = 1;
44+
45+
// Role that is assigned to "members".
46+
// For example, "roles/viewer", "roles/editor", or "roles/owner".
47+
string role = 2;
48+
49+
// A single identity requesting access for a Cloud Platform resource,
50+
// e.g. "[email protected]".
51+
string member = 3;
52+
}

‎google/cloud/securitycenter/v1/indicator.proto‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,14 @@ syntax = "proto3";
1616

1717
package google.cloud.securitycenter.v1;
1818

19+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
1920
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
2021
option java_multiple_files = true;
2122
option java_outer_classname = "IndicatorProto";
2223
option java_package = "com.google.cloud.securitycenter.v1";
23-
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
2424
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
2525
option ruby_package = "Google::Cloud::SecurityCenter::V1";
2626

27-
2827
// Represents what's commonly known as an Indicator of compromise (IoC) in
2928
// computer forensics. This is an artifact observed on a network or in an
3029
// operating system that, with high confidence, indicates a computer intrusion.

‎google/cloud/securitycenter/v1/mitre_attack.proto‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ message MitreAttack {
7878

7979
// MITRE ATT&CK techniques that can be referenced by SCC findings.
8080
// See: https://attack.mitre.org/techniques/enterprise/
81+
// Next ID: 30
8182
enum Technique {
8283
// Unspecified value.
8384
TECHNIQUE_UNSPECIFIED = 0;
@@ -165,6 +166,9 @@ message MitreAttack {
165166

166167
// T1556
167168
MODIFY_AUTHENTICATION_PROCESS = 28;
169+
170+
// T1485
171+
DATA_DESTRUCTION = 29;
168172
}
169173

170174
// The MITRE ATT&CK tactic most closely represented by this finding, if any.

‎google/cloud/securitycenter/v1/resource.proto‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,16 @@ message Resource {
3333
// https://cloud.google.com/apis/design/resource_names#full_resource_name
3434
string name = 1;
3535

36+
// The human readable name of the resource.
37+
string display_name = 8;
38+
39+
// The full resource type of the resource.
40+
string type = 6;
41+
3642
// The full resource name of project that the resource belongs to.
3743
string project = 2;
3844

39-
// The project id that the resource belongs to.
45+
// The project ID that the resource belongs to.
4046
string project_display_name = 3;
4147

4248
// The full resource name of resource's parent.
@@ -45,14 +51,8 @@ message Resource {
4551
// The human readable name of resource's parent.
4652
string parent_display_name = 5;
4753

48-
// The full resource type of the resource.
49-
string type = 6;
50-
5154
// Output only. Contains a Folder message for each folder in the assets ancestry.
5255
// The first folder is the deepest nested folder, and the last folder is the
5356
// folder directly under the Organization.
5457
repeated Folder folders = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
55-
56-
// The human readable name of the resource.
57-
string display_name = 8;
5858
}

‎google/cloud/securitycenter/v1/securitycenter_service.proto‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1574,10 +1574,16 @@ message ListFindingsResponse {
15741574
// https://cloud.google.com/apis/design/resource_names#full_resource_name
15751575
string name = 1;
15761576

1577+
// The human readable name of the resource.
1578+
string display_name = 8;
1579+
1580+
// The full resource type of the resource.
1581+
string type = 6;
1582+
15771583
// The full resource name of project that the resource belongs to.
15781584
string project_name = 2;
15791585

1580-
// The project id that the resource belongs to.
1586+
// The project ID that the resource belongs to.
15811587
string project_display_name = 3;
15821588

15831589
// The full resource name of resource's parent.
@@ -1586,16 +1592,10 @@ message ListFindingsResponse {
15861592
// The human readable name of resource's parent.
15871593
string parent_display_name = 5;
15881594

1589-
// The full resource type of the resource.
1590-
string type = 6;
1591-
15921595
// Contains a Folder message for each folder in the assets ancestry.
15931596
// The first folder is the deepest nested folder, and the last folder is
15941597
// the folder directly under the Organization.
15951598
repeated Folder folders = 7;
1596-
1597-
// The human readable name of the resource.
1598-
string display_name = 8;
15991599
}
16001600

16011601
// Finding matching the search request.
@@ -1765,7 +1765,7 @@ message UpdateSecurityMarksRequest {
17651765
// The time at which the updated SecurityMarks take effect.
17661766
// If not set uses current server time. Updates will be applied to the
17671767
// SecurityMarks that are active immediately preceding this time. Must be
1768-
// smaller or equal to the server time.
1768+
// earlier or equal to the server time.
17691769
google.protobuf.Timestamp start_time = 3;
17701770
}
17711771

0 commit comments

Comments
 (0)