Security Command Center v2 API - Namespace Google.Cloud.SecurityCenter.V2 (1.0.0-beta03)

Represents an access event.

Represents an application associated with a finding.

An attack exposure contains the results of an attack path simulation run.

Container for nested types declared in the AttackExposure message type.

A path that an attacker could take to reach an exposed resource.

Container for nested types declared in the AttackPath message type.

Represents a connection between a source node and a destination node in this attack path.

Represents one point that an attacker passes through in this attack path.

Container for nested types declared in the AttackPathNode message type.

Detailed steps the attack can take between path nodes.

A finding that is associated with this node in the attack path.

Resource name for the AttackPath resource.

Information related to Google Cloud Backup and DR Service findings.

Request message to create multiple resource value configs

Response message for BatchCreateResourceValueConfigs

Configures how to deliver Findings to BigQuery Instance.

Resource name for the BigQueryExport resource.

Request message for bulk findings update.

Note:

1. If multiple bulk update requests match the same resource, the order in which they get executed is not defined.
2. Once a bulk operation is started, there is no way to stop it.

The response to a BulkMute request. Contains the LRO information.

The data profile associated with the finding.

Container for nested types declared in the CloudDlpDataProfile message type.

Details about the Cloud Data Loss Prevention (Cloud DLP) inspection job that produced the finding.

Metadata taken from a Cloud Logging LogEntry

Contains compliance information about a security standard indicating unmet recommendations.

Contains information about the IP connection associated with the finding.

Container for nested types declared in the Connection message type.

The email address of a contact.

Details about specific contacts

Container associated with the finding.

Request message for creating a BigQuery export.

Request message for creating a finding.

Request message for creating a mute config.

Request message for creating a notification config.

Request message to create single resource value config

Request message for creating a source.

CVE stands for Common Vulnerabilities and Exposures. Information from the CVE record that describes this vulnerability.

Container for nested types declared in the Cve message type.

Common Vulnerability Scoring System version 3.

Container for nested types declared in the Cvssv3 message type.

Represents database access information, such as queries. A database may be a sub-resource of an instance (as in the case of Cloud SQL instances or Cloud Spanner instances), or the database instance itself. Some database resources might not have the full resource name populated because these resource types, such as Cloud SQL databases, are not yet supported by Cloud Asset Inventory. In these cases only the display name is provided.

Request message for deleting a BigQuery export.

Request message for deleting a mute config. If no location is specified, default is global.

Request message for deleting a notification config.

Request message to delete resource value config

Resource name for the DlpJob resource.

A name-value pair representing an environment variable used in an operating system process.

Resource where data was exfiltrated from or exfiltrated to.

Exfiltration represents a data exfiltration attempt from one or more sources to one or more targets. The sources attribute lists the sources of the exfiltrated data. The targets attribute lists the destinations the data was copied to.

Representation of third party SIEM/SOAR fields within SCC.

Container for nested types declared in the ExternalSystem message type.

Information about the ticket, if any, that is being used to track the resolution of the issue that is identified by this finding.

Resource name for the ExternalSystem resource.

File information about the related binary/library used by an executable, or the script used by a script interpreter

Container for nested types declared in the File message type.

Path of the file in terms of underlying disk/partition identifiers.

Security Command Center finding.

A finding is a record of assessment data like security, risk, health, or privacy, that is ingested into Security Command Center for presentation, notification, analysis, policy testing, and enforcement. For example, a cross-site scripting (XSS) vulnerability in an App Engine application is a finding.

Container for nested types declared in the Finding message type.

Resource name for the Finding resource.

Resource name for the FolderLocation resource.

Represents a geographical location for a given access.

Request message for retrieving a BigQuery export.

Request message for retrieving a mute config. If no location is specified, default is global.

Request message for getting a notification config.

Request message to get resource value config

Request message for getting simulation. Simulation name can include "latest" to retrieve the latest simulation For example, "organizations/123/simulations/latest"

Request message for getting a source.

Request message for getting a valued resource.

Request message for grouping by findings.

Response message for group by findings.

Result containing the properties and count of a groupBy request.

Represents a particular IAM binding, which captures a member's role addition, removal, or state.

Container for nested types declared in the IamBinding message type.

Represents what's commonly known as an indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. For more information, see Indicator of compromise.

Container for nested types declared in the Indicator message type.

Indicates what signature matched this process.

Container for nested types declared in the ProcessSignature message type.

A signature corresponding to memory page hashes.

Container for nested types declared in the MemoryHashSignature message type.

Memory hash detection contributing to the binary family match.

A signature corresponding to a YARA rule.

Kernel mode rootkit signatures.

Kubernetes-related attributes.

Container for nested types declared in the Kubernetes message type.

Conveys information about a Kubernetes access review (such as one returned by a kubectl auth can-i command) that was involved in a finding.

Represents a Kubernetes RoleBinding or ClusterRoleBinding.

Kubernetes nodes associated with the finding.

Provides GKE node pool information.

Kubernetes object related to the finding, uniquely identified by GKNN. Used if the object Kind is not one of Pod, Node, NodePool, Binding, or AccessReview.

A Kubernetes Pod.

Kubernetes Role or ClusterRole.

Container for nested types declared in the Role message type.

Represents a Kubernetes subject.

Container for nested types declared in the Subject message type.

Represents a generic name-value label. A label has separate name and value fields to support filtering with the contains() function. For more information, see Filtering on array-type fields.

Request message for listing the attack paths for a given simulation or valued resource.

Response message for listing the attack paths for a given simulation or valued resource.

Request message for listing BigQuery exports at a given scope e.g. organization, folder or project.

Response message for listing BigQuery exports.

Request message for listing findings.

Response message for listing findings.

Container for nested types declared in the ListFindingsResponse message type.

Result containing the Finding.

Container for nested types declared in the ListFindingsResult message type.

Information related to the Google Cloud resource that is associated with this finding.

Request message for listing mute configs at a given scope e.g. organization, folder or project. If no location is specified, default is global.

Response message for listing mute configs.

Request message for listing notification configs.

Response message for listing notification configs.

Request message to list resource value configs of a parent

Response message to list resource value configs

Request message for listing sources.

Response message for listing sources.

Request message for listing the valued resources for a given simulation.

Response message for listing the valued resources for a given simulation.

Contains information related to the load balancer associated with the finding.

An individual entry in a log.

MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org

Container for nested types declared in the MitreAttack message type.

A mute config is a Cloud SCC resource that contains the configuration to mute create/update events of findings.

Container for nested types declared in the MuteConfig message type.

Resource name for the MuteConfig resource.

Cloud Security Command Center (Cloud SCC) notification configs.

A notification config is a Cloud SCC resource that contains the configuration to send notifications for create/update events of findings, assets and etc.

Container for nested types declared in the NotificationConfig message type.

The config for streaming-based notifications, which send each event as soon as it is detected.

Resource name for the NotificationConfig resource.

Cloud SCC's Notification

Contains information about the org policies associated with the finding.

Resource name for the OrganizationLocation resource.

Package is a generic definition of a package.

Resource name for the Policy resource.

Represents an operating system process.

Additional Links

Information related to the Google Cloud resource.

A resource value config (RVC) is a mapping configuration of user's resources to resource values. Used in Attack path simulations.

Container for nested types declared in the ResourceValueConfig message type.

Resource value mapping for Sensitive Data Protection findings If any of these mappings have a resource value that is not unspecified, the resource_value field will be ignored when reading this configuration.

Metadata about a ResourceValueConfig. For example, id and name.

Resource name for the ResourceValueConfig resource.

SecurityBulletin are notifications of vulnerabilities of Google products.

V2 APIs for Security Center service.

Base class for server-side implementations of SecurityCenter

Client for SecurityCenter

SecurityCenter client wrapper, for convenient use.

Builder class for SecurityCenterClient to provide simple configuration of credentials, endpoint etc.

SecurityCenter client wrapper implementation, for convenient use.

Settings for SecurityCenterClient instances.

User specified security marks that are attached to the parent Security Command Center resource. Security marks are scoped within a Security Command Center organization -- they can be modified and viewed by all users who have proper permissions on the organization.

Resource name for the SecurityMarks resource.

Represents a posture that is deployed on Google Cloud by the Security Command Center Posture Management service. A posture contains one or more policy sets. A policy set is a group of policies that enforce a set of security rules on Google Cloud.

Container for nested types declared in the SecurityPosture message type.

The policy field that violates the deployed posture and its expected and detected values.

Identity delegation history of an authenticated service account.

Request message for updating a finding's state.

Request message for updating a finding's mute status.

Attack path simulation

Resource name for the Simulation resource.

Security Command Center finding source. A finding source is an entity or a mechanism that can produce a finding. A source is like a container of findings that come from the same scanner, logger, monitor, and other tools.

Resource name for the Source resource.

Resource name for the TableDataProfile resource.

Resource name for the Topic resource.

Request message for updating a BigQuery export.

Request message for updating a ExternalSystem resource.

Request message for updating or creating a finding.

Request message for updating a mute config.

Request message for updating a notification config.

Request message to update resource value config

Request message for updating a SecurityMarks resource.

Request message for updating a source.

A resource that is determined to have value to a user's system

Container for nested types declared in the ValuedResource message type.

Resource name for the ValuedResource resource.

Refers to common vulnerability fields e.g. cve, cvss, cwe etc.

This enum defines the various states an AttackExposure can be in.

The type of the incoming attack step node.

The possible contents of AttackPathName.

The possible contents of BigQueryExportName.

Parents for configurations that produce data profile findings.

IANA Internet Protocol Number such as TCP(6) and UDP(17).

The possible values of exploitation activity of the vulnerability in the wild.

The possible values of impact of the vulnerability if it was to be exploited.

This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.

This metric reflects the context by which vulnerability exploitation is possible.

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack.

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

The possible contents of DlpJobName.

The possible contents of ExternalSystemName.

Represents what kind of Finding it is.

Mute state a finding can be in.

The severity of the finding.

The state of the finding.

The possible contents of FindingName.

The possible contents of FolderLocationName.

The type of action performed on a Binding in a policy.

Enum of possible cases for the "signature" oneof.

Possible resource types to be associated with a signature.

Types of Kubernetes roles.

Auth types that can be used for the subject's kind field.

Enum of possible cases for the "log_entry" oneof.

MITRE ATT&CK tactics that can be referenced by SCC findings. See: https://attack.mitre.org/tactics/enterprise/

MITRE ATT&CK techniques that can be referenced by SCC findings. See: https://attack.mitre.org/techniques/enterprise/ Next ID: 59

The type of MuteConfig.

The possible contents of MuteConfigName.

Enum of possible cases for the "notify_config" oneof.

The possible contents of NotificationConfigName.

Enum of possible cases for the "event" oneof.

The possible contents of OrganizationLocationName.

The possible contents of PolicyName.

Value enum to map to a resource

The possible contents of ResourceValueConfigName.

The possible contents of SecurityMarksName.

The possible contents of SimulationName.

The possible contents of SourceName.

The possible contents of TableDataProfileName.

The possible contents of TopicName.

How valuable the resource is.

The possible contents of ValuedResourceName.