Class Finding (2.5.6)

Stay organized with collections Save and categorize content based on your preferences.

Security Command Center finding. A finding is a record of assessment data like security, risk, health, or privacy, that is ingested into Security Command Center for presentation, notification, analysis, policy testing, and enforcement. For example, a cross-site scripting (XSS) vulnerability in an App Engine application is a finding.

Protobuf type google.cloud.securitycenter.v1.Finding

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

map<string, .google.cloud.securitycenter.v1.ExternalSystem> external_systems = 22 [(.google.api.field_behavior) = OUTPUT_ONLY];

Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.

map<string, .google.protobuf.Value> source_properties = 7;

Access details associated to the Finding, such as more information on the caller, which method was accessed, from where, etc.

.google.cloud.securitycenter.v1.Access access = 26;

Access details associated to the Finding, such as more information on the caller, which method was accessed, from where, etc.

.google.cloud.securitycenter.v1.Access access = 26;

The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or "projects/{project_number}/sources/{source_id}/findings/{finding_id}", depending on the closest CRM ancestor of the resource associated with the finding.

string canonical_name = 14;

The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or "projects/{project_number}/sources/{source_id}/findings/{finding_id}", depending on the closest CRM ancestor of the resource associated with the finding.

string canonical_name = 14;

The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"

string category = 5;

The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"

string category = 5;

The time at which the finding was created in Security Command Center.

.google.protobuf.Timestamp create_time = 10;

The time at which the finding was created in Security Command Center.

.google.protobuf.Timestamp create_time = 10;

The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.

.google.protobuf.Timestamp event_time = 9;

The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.

.google.protobuf.Timestamp event_time = 9;

Use #getExternalSystemsMap() instead.

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

map<string, .google.cloud.securitycenter.v1.ExternalSystem> external_systems = 22 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

map<string, .google.cloud.securitycenter.v1.ExternalSystem> external_systems = 22 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

map<string, .google.cloud.securitycenter.v1.ExternalSystem> external_systems = 22 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

map<string, .google.cloud.securitycenter.v1.ExternalSystem> external_systems = 22 [(.google.api.field_behavior) = OUTPUT_ONLY];

The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.

string external_uri = 6;

The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.

string external_uri = 6;

The class of the finding.

.google.cloud.securitycenter.v1.Finding.FindingClass finding_class = 17;

The class of the finding.

.google.cloud.securitycenter.v1.Finding.FindingClass finding_class = 17;

Represents what's commonly known as an Indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise

.google.cloud.securitycenter.v1.Indicator indicator = 18;

Represents what's commonly known as an Indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise

.google.cloud.securitycenter.v1.Indicator indicator = 18;

MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org

.google.cloud.securitycenter.v1.MitreAttack mitre_attack = 25;

MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org

.google.cloud.securitycenter.v1.MitreAttack mitre_attack = 25;

Indicates the mute state of a finding (either unspecified, muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.

.google.cloud.securitycenter.v1.Finding.Mute mute = 15;

First known as mute_annotation. Records additional information about the mute operation e.g. mute config that muted the finding, user who muted the finding, etc. Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.

string mute_initiator = 28;

First known as mute_annotation. Records additional information about the mute operation e.g. mute config that muted the finding, user who muted the finding, etc. Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.

string mute_initiator = 28;

Output only. The most recent time this finding was muted or unmuted.

.google.protobuf.Timestamp mute_update_time = 21 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. The most recent time this finding was muted or unmuted.

.google.protobuf.Timestamp mute_update_time = 21 [(.google.api.field_behavior) = OUTPUT_ONLY];

Indicates the mute state of a finding (either unspecified, muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.

.google.cloud.securitycenter.v1.Finding.Mute mute = 15;

The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}"

string name = 1;

The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}"

string name = 1;

The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/{organization_id}/sources/{source_id}"

string parent = 2;

The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/{organization_id}/sources/{source_id}"

string parent = 2;

For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time.

string resource_name = 3;

For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time.

string resource_name = 3;

Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.

.google.cloud.securitycenter.v1.SecurityMarks security_marks = 8 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.

.google.cloud.securitycenter.v1.SecurityMarks security_marks = 8 [(.google.api.field_behavior) = OUTPUT_ONLY];

The severity of the finding. This field is managed by the source that writes the finding.

.google.cloud.securitycenter.v1.Finding.Severity severity = 12;

The severity of the finding. This field is managed by the source that writes the finding.

.google.cloud.securitycenter.v1.Finding.Severity severity = 12;

Use #getSourcePropertiesMap() instead.

Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.

map<string, .google.protobuf.Value> source_properties = 7;

Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.

map<string, .google.protobuf.Value> source_properties = 7;

Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.

map<string, .google.protobuf.Value> source_properties = 7;

Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.

map<string, .google.protobuf.Value> source_properties = 7;

The state of the finding.

.google.cloud.securitycenter.v1.Finding.State state = 4;

The state of the finding.

.google.cloud.securitycenter.v1.Finding.State state = 4;

Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)

.google.cloud.securitycenter.v1.Vulnerability vulnerability = 20;

Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)

.google.cloud.securitycenter.v1.Vulnerability vulnerability = 20;

Access details associated to the Finding, such as more information on the caller, which method was accessed, from where, etc.

.google.cloud.securitycenter.v1.Access access = 26;

The time at which the finding was created in Security Command Center.

.google.protobuf.Timestamp create_time = 10;

The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.

.google.protobuf.Timestamp event_time = 9;

Represents what's commonly known as an Indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise

.google.cloud.securitycenter.v1.Indicator indicator = 18;

MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org

.google.cloud.securitycenter.v1.MitreAttack mitre_attack = 25;

Output only. The most recent time this finding was muted or unmuted.

.google.protobuf.Timestamp mute_update_time = 21 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.

.google.cloud.securitycenter.v1.SecurityMarks security_marks = 8 [(.google.api.field_behavior) = OUTPUT_ONLY];

Represents vulnerability specific fields like cve, cvss scores etc. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)

.google.cloud.securitycenter.v1.Vulnerability vulnerability = 20;