Google Cloud Security Command Center v1 API - Namespace Google.Cloud.SecurityCenter.V1 (3.5.0)

Represents an access event.

Security Command Center representation of a Google Cloud resource.

The Asset is a Security Command Center resource that captures information about a single Google Cloud resource. All modifications to an Asset are only within the context of Security Command Center and don't affect the referenced Google Cloud resource.

Container for nested types declared in the Asset message type.

Cloud IAM Policy information associated with the Google Cloud resource described by the Security Command Center asset. This information is managed and defined by the Google Cloud resource and cannot be modified by the user.

Security Command Center managed properties. These properties are managed by Security Command Center and cannot be modified by the user.

Resource name for the Asset resource.

Configures how to deliver Findings to BigQuery Instance.

Resource name for the BigQueryExport resource.

Request message for bulk findings update.

Note:

1. If multiple bulk update requests match the same resource, the order in which they get executed is not defined.
2. Once a bulk operation is started, there is no way to stop it.

The response to a BulkMute request. Contains the LRO information.

Contains compliance information about a security standard indicating unmet recommendations.

Contains information about the IP connection associated with the finding.

Container for nested types declared in the Connection message type.

Representa a single contact's email address

The details pertaining to specific contacts

Container associated with the finding.

Request message for creating a big query export.

Request message for creating a finding.

Request message for creating a mute config.

Request message for creating a notification config.

Request message for creating a source.

CVE stands for Common Vulnerabilities and Exposures. More information: https://cve.mitre.org

Common Vulnerability Scoring System version 3.

Container for nested types declared in the Cvssv3 message type.

Represents database access information, such as queries. A database may be a sub-resource of an instance (as in the case of CloudSQL instances or Cloud Spanner instances), or the database instance itself. Some database resources may not have the full resource name populated because these resource types are not yet supported by Cloud Asset Inventory (e.g. CloudSQL databases). In these cases only the display name will be provided.

Request message for deleting a big query export.

Request message for deleting a mute config.

Request message for deleting a notification config.

EnvironmentVariable is a name-value pair to store environment variables for Process.

Resource that has been exfiltrated or exfiltrated_to.

Exfiltration represents a data exfiltration attempt of one or more sources to one or more targets. Sources represent the source of data that is exfiltrated, and Targets represents the destination the data was copied to.

Representation of third party SIEM/SOAR fields within SCC.

Resource name for the ExternalSystem resource.

File information about the related binary/library used by an executable, or the script used by a script interpreter

Security Command Center finding.

A finding is a record of assessment data like security, risk, health, or privacy, that is ingested into Security Command Center for presentation, notification, analysis, policy testing, and enforcement. For example, a cross-site scripting (XSS) vulnerability in an App Engine application is a finding.

Container for nested types declared in the Finding message type.

Resource name for the Finding resource.

Message that contains the resource name and display name of a folder resource.

Represents a geographical location for a given access.

Request message for retrieving a big query export.

Request message for retrieving a mute config.

Request message for getting a notification config.

Request message for getting organization settings.

Request message for getting a source.

Request message for grouping by assets.

Response message for grouping by assets.

Request message for grouping by findings.

Response message for group by findings.

Result containing the properties and count of a groupBy request.

Represents a particular IAM binding, which captures a member's role addition, removal, or state.

Container for nested types declared in the IamBinding message type.

Represents what's commonly known as an Indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise

Container for nested types declared in the Indicator message type.

Indicates what signature matched this process.

Container for nested types declared in the ProcessSignature message type.

A signature corresponding to memory page hashes.

Container for nested types declared in the MemoryHashSignature message type.

Memory hash detection contributing to the binary family match.

A signature corresponding to a YARA rule.

Kubernetes related attributes.

Container for nested types declared in the Kubernetes message type.

Conveys information about a Kubernetes access review (e.g. kubectl auth can-i ...) that was involved in a finding.

Represents a Kubernetes RoleBinding or ClusterRoleBinding.

Kubernetes Nodes associated with the finding.

Provides GKE Node Pool information.

Kubernetes Pod.

Kubernetes Role or ClusterRole.

Container for nested types declared in the Role message type.

Represents a Kubernetes Subject.

Container for nested types declared in the Subject message type.

Label represents a generic name=value label. Label has separate name and value fields to support filtering with contains().

Request message for listing assets.

Response message for listing assets.

Container for nested types declared in the ListAssetsResponse message type.

Result containing the Asset and its State.

Container for nested types declared in the ListAssetsResult message type.

Request message for listing BigQuery exports at a given scope e.g. organization, folder or project.

Response message for listing BigQuery exports.

Request message for listing findings.

Response message for listing findings.

Container for nested types declared in the ListFindingsResponse message type.

Result containing the Finding and its StateChange.

Container for nested types declared in the ListFindingsResult message type.

Information related to the Google Cloud resource that is associated with this finding.

Request message for listing mute configs at a given scope e.g. organization, folder or project.

Response message for listing mute configs.

Request message for listing notification configs.

Response message for listing notification configs.

Request message for listing sources.

Response message for listing sources.

MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org

Container for nested types declared in the MitreAttack message type.

A mute config is a Cloud SCC resource that contains the configuration to mute create/update events of findings.

Resource name for the MuteConfig resource.

Cloud Security Command Center (Cloud SCC) notification configs.

A notification config is a Cloud SCC resource that contains the configuration to send notifications for create/update events of findings, assets and etc.

Container for nested types declared in the NotificationConfig message type.

The config for streaming-based notifications, which send each event as soon as it is detected.

Resource name for the NotificationConfig resource.

Cloud SCC's Notification

User specified settings that are attached to the Security Command Center organization.

Container for nested types declared in the OrganizationSettings message type.

The configuration used for Asset Discovery runs.

Container for nested types declared in the AssetDiscoveryConfig message type.

Resource name for the OrganizationSettings resource.

Represents an operating system process.

Additional Links

Information related to the Google Cloud resource.

Request message for running asset discovery for an organization.

Response of asset discovery run

Container for nested types declared in the RunAssetDiscoveryResponse message type.

V1 APIs for Security Center service.

Base class for server-side implementations of SecurityCenter

Client for SecurityCenter

SecurityCenter client wrapper, for convenient use.

Builder class for SecurityCenterClient to provide simple configuration of credentials, endpoint etc.

SecurityCenter client wrapper implementation, for convenient use.

Settings for SecurityCenterClient instances.

User specified security marks that are attached to the parent Security Command Center resource. Security marks are scoped within a Security Command Center organization -- they can be modified and viewed by all users who have proper permissions on the organization.

Resource name for the SecurityMarks resource.

Identity delegation history of an authenticated service account.

Request message for updating a finding's state.

Request message for updating a finding's mute status.

Security Command Center finding source. A finding source is an entity or a mechanism that can produce a finding. A source is like a container of findings that come from the same scanner, logger, monitor, and other tools.

Resource name for the Source resource.

Resource name for the Topic resource.

Request message for updating a BigQuery export.

Request message for updating a ExternalSystem resource.

Request message for updating or creating a finding.

Request message for updating a mute config.

Request message for updating a notification config.

Request message for updating an organization's settings.

Request message for updating a SecurityMarks resource.

Request message for updating a source.

Refers to common vulnerability fields e.g. cve, cvss, cwe etc.

The possible contents of AssetName.

The possible contents of BigQueryExportName.

IANA Internet Protocol Number such as TCP(6) and UDP(17).

This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.

This metric reflects the context by which vulnerability exploitation is possible.

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack.

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

The possible contents of ExternalSystemName.

Represents what kind of Finding it is.

Mute state a finding can be in.

The severity of the finding.

The state of the finding.

The possible contents of FindingName.

The type of action performed on a Binding in a policy.

Enum of possible cases for the "signature" oneof.

Types of Kubernetes roles.

Auth types that can be used for Subject's kind field.

The change in state of the asset.

When querying across two points in time this describes the change between the two points: ADDED, REMOVED, or ACTIVE. If there was no compare_duration supplied in the request the state change will be: UNUSED

The change in state of the finding.

When querying across two points in time this describes the change in the finding between the two points: CHANGED, UNCHANGED, ADDED, or REMOVED. Findings can not be deleted, so REMOVED implies that the finding at timestamp does not match the filter specified, but it did at timestamp - compare_duration. If there was no compare_duration supplied in the request the state change will be: UNUSED

MITRE ATT&CK tactics that can be referenced by SCC findings. See: https://attack.mitre.org/tactics/enterprise/

MITRE ATT&CK techniques that can be referenced by SCC findings. See: https://attack.mitre.org/techniques/enterprise/

The possible contents of MuteConfigName.

Enum of possible cases for the "notify_config" oneof.

The possible contents of NotificationConfigName.

Enum of possible cases for the "event" oneof.

The mode of inclusion when running Asset Discovery. Asset discovery can be limited by explicitly identifying projects to be included or excluded. If INCLUDE_ONLY is set, then only those projects within the organization and their children are discovered during asset discovery. If EXCLUDE is set, then projects that don't match those projects are discovered during asset discovery. If neither are set, then all projects within the organization are discovered during asset discovery.

The possible contents of OrganizationSettingsName.

The state of an asset discovery run.

The possible contents of SecurityMarksName.

The possible contents of SourceName.

The possible contents of TopicName.