1// Copyright 2020 Google LLC 2// 3// Licensed under the Apache License, Version 2.0 (the "License"); 4// you may not use this file except in compliance with the License. 5// You may obtain a copy of the License at 6// 7// http://www.apache.org/licenses/LICENSE-2.0 8// 9// Unless required by applicable law or agreed to in writing, software 10// distributed under the License is distributed on an "AS IS" BASIS, 11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12// See the License for the specific language governing permissions and 13// limitations under the License. 14 15syntax = "proto3"; 16 17package google.cloud.securitycenter.v1beta1; 18 19import "google/api/field_behavior.proto"; 20import "google/api/resource.proto"; 21import "google/cloud/securitycenter/v1beta1/security_marks.proto"; 22import "google/protobuf/struct.proto"; 23import "google/protobuf/timestamp.proto"; 24 25option go_package = "cloud.google.com/go/securitycenter/apiv1beta1/securitycenterpb;securitycenterpb"; 26option java_multiple_files = true; 27option java_package = "com.google.cloud.securitycenter.v1beta1"; 28 29// Security Command Center finding. 30// 31// A finding is a record of assessment data (security, risk, health or privacy) 32// ingested into Security Command Center for presentation, notification, 33// analysis, policy testing, and enforcement. For example, an XSS vulnerability 34// in an App Engine application is a finding. 35message Finding { 36 option (google.api.resource) = { 37 type: "securitycenter.googleapis.com/Finding" 38 pattern: "organizations/{organization}/sources/{source}/findings/{finding}" 39 }; 40 41 // The state of the finding. 42 enum State { 43 // Unspecified state. 44 STATE_UNSPECIFIED = 0; 45 46 // The finding requires attention and has not been addressed yet. 47 ACTIVE = 1; 48 49 // The finding has been fixed, triaged as a non-issue or otherwise addressed 50 // and is no longer active. 51 INACTIVE = 2; 52 } 53 54 // The relative resource name of this finding. See: 55 // https://cloud.google.com/apis/design/resource_names#relative_resource_name 56 // Example: 57 // "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}" 58 string name = 1; 59 60 // Immutable. The relative resource name of the source the finding belongs to. 61 // See: 62 // https://cloud.google.com/apis/design/resource_names#relative_resource_name 63 // This field is immutable after creation time. 64 // For example: 65 // "organizations/{organization_id}/sources/{source_id}" 66 string parent = 2 [(google.api.field_behavior) = IMMUTABLE]; 67 68 // For findings on Google Cloud resources, the full resource 69 // name of the Google Cloud resource this finding is for. See: 70 // https://cloud.google.com/apis/design/resource_names#full_resource_name 71 // When the finding is for a non-Google Cloud resource, the resourceName can 72 // be a customer or partner defined string. This field is immutable after 73 // creation time. 74 string resource_name = 3; 75 76 // The state of the finding. 77 State state = 4; 78 79 // The additional taxonomy group within findings from a given source. 80 // This field is immutable after creation time. 81 // Example: "XSS_FLASH_INJECTION" 82 string category = 5; 83 84 // The URI that, if available, points to a web page outside of Security 85 // Command Center where additional information about the finding can be found. 86 // This field is guaranteed to be either empty or a well formed URL. 87 string external_uri = 6; 88 89 // Source specific properties. These properties are managed by the source 90 // that writes the finding. The key names in the source_properties map must be 91 // between 1 and 255 characters, and must start with a letter and contain 92 // alphanumeric characters or underscores only. 93 map<string, google.protobuf.Value> source_properties = 7; 94 95 // Output only. User specified security marks. These marks are entirely 96 // managed by the user and come from the SecurityMarks resource that belongs 97 // to the finding. 98 SecurityMarks security_marks = 8 [(google.api.field_behavior) = OUTPUT_ONLY]; 99 100 // The time at which the event took place, or when an update to the finding 101 // occurred. For example, if the finding represents an open firewall it would 102 // capture the time the detector believes the firewall became open. The 103 // accuracy is determined by the detector. If the finding were to be resolved 104 // afterward, this time would reflect when the finding was resolved. 105 google.protobuf.Timestamp event_time = 9; 106 107 // The time at which the finding was created in Security Command Center. 108 google.protobuf.Timestamp create_time = 10; 109} 110