str
Required. Name of the source to groupBy. If no location is
specified, finding is assumed to be in global. The following
list shows some examples:
- organizations/[organization_id]/sources/[source_id]
-
organizations/[organization_id]/sources/[source_id]/locations/[location_id]
- folders/[folder_id]/sources/[source_id]
- folders/[folder_id]/sources/[source_id]/locations/[location_id]
- projects/[project_id]/sources/[source_id]
- projects/[project_id]/sources/[source_id]/locations/[location_id]
To groupBy across all sources provide a source_id of -.
The following list shows some examples:
- organizations/{organization_id}/sources/-
- organizations/{organization_id}/sources/-/locations/[location_id]
- folders/{folder_id}/sources/-
- folders/{folder_id}/sources/-/locations/[location_id]
- projects/{project_id}/sources/-
- projects/{project_id}/sources/-/locations/[location_id]
filter
str
Expression that defines the filter to apply across findings.
The expression is a list of one or more restrictions
combined via logical operators AND and OR.
Parentheses are supported, and OR has higher precedence
than AND.
Restrictions have the form
and may have a - character in front of them to indicate
negation. Examples include:
- name
- security_marks.marks.marka
The supported operators are:
- = for all value types.
- >, , >=, <> for integer values.
- :, meaning substring matching, for strings.
The supported value types are:
- string literals in quotes.
- integer literals without quotes.
- boolean literals true and false without quotes.
The following field and operator combinations are supported:
- name: =
- parent: =, :
- resource_name: =, :
- state: =, :
- category: =, :
- external_uri: =, :
- event_time: =, >, , >=, <>
Usage: This should be milliseconds since epoch or an
RFC3339 string. Examples:
event_time = "2019-06-10T16:07:18-07:00"event_time = 1560208038000
- severity: =, :
- security_marks.marks: =, :
- resource:
- resource.name: =, :
- resource.parent_name: =, :
- resource.parent_display_name: =, :
- resource.project_name: =, :
- resource.project_display_name: =, :
- resource.type: =, :
group_by
str
Required. Expression that defines what assets fields to use
for grouping. The string value should follow SQL syntax:
comma separated list of fields. For example:
"parent,resource_name".
page_token
str
The value returned by the last GroupFindingsResponse;
indicates that this is a continuation of a prior
GroupFindings call, and that the system should return
the next page of data.
page_size
int
The maximum number of results to return in a
single response. Default is 10, minimum is 1,
maximum is 1000.
