REST Resource: organizations.sources.findings

Resource: Finding

Cloud Security Command Center (Cloud SCC) finding.

A finding is a record of assessment data (security, risk, health or privacy) ingested into Cloud SCC for presentation, notification, analysis, policy testing, and enforcement. For example, an XSS vulnerability in an App Engine application is a finding.

JSON representation
{
  "name": string,
  "parent": string,
  "resourceName": string,
  "state": enum (State),
  "category": string,
  "externalUri": string,
  "sourceProperties": {
    string: value,
    ...
  },
  "securityMarks": {
    object (SecurityMarks)
  },
  "eventTime": string,
  "createTime": string
}
Fields
name

string

The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/123/sources/456/findings/789"

parent

string

The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/123/sources/456"

resourceName

string

The full resource name of the Google Cloud Platform (GCP) resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name This field is immutable after creation time.

state

enum (State)

The state of the finding.

category

string

The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"

externalUri

string

The URI that, if available, points to a web page outside of Cloud SCC where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.

sourceProperties

map (key: string, value: value (Value format))

Source specific properties. These properties are managed by the source that writes the finding. The key names in the sourceProperties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

securityMarks

object (SecurityMarks)

Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.

eventTime

string (Timestamp format)

The time at which the event took place. For example, if the finding represents an open firewall it would capture the time the open firewall was detected.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

createTime

string (Timestamp format)

The time at which the finding was created in Cloud SCC.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

State

The state of the finding.

Enums
STATE_UNSPECIFIED Unspecified state.
ACTIVE The finding requires attention and has not been addressed yet.
INACTIVE The finding has been fixed, triaged as a non-issue or otherwise addressed and is no longer active.

SecurityMarks

User specified security marks that are attached to the parent Cloud Security Command Center (Cloud SCC) resource. Security marks are scoped within a Cloud SCC organization -- they can be modified and viewed by all users who have proper permissions on the organization.

JSON representation
{
  "name": string,
  "marks": {
    string: string,
    ...
  }
}
Fields
name

string

The relative resource name of the SecurityMarks. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Examples: "organizations/123/assets/456/securityMarks" "organizations/123/sources/456/findings/789/securityMarks".

marks

map (key: string, value: string)

Mutable user specified security marks belonging to the parent resource. Constraints are as follows: - Keys and values are treated as case insensitive - Keys must be between 1 - 256 characters (inclusive) - Keys must be letters, numbers, underscores, or dashes - Values have leading and trailing whitespace trimmed, remaining characters must be between 1 - 4096 characters (inclusive)

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

Methods

create

Creates a finding.

group

Filters an organization or source's findings and groups them by their specified properties.

list

Lists an organization or source's findings.

patch

Creates or updates a finding.

setState

Updates the state of a finding.

updateSecurityMarks

Updates security marks.
Was this page helpful? Let us know how we did:

Send feedback about...

Cloud Security Command Center
Need help? Visit our support page.