- HTTP request
- Path parameters
- Query parameters
- Request body
- Response body
- Authorization Scopes
- ListFindingsResult
- StateChange
- Resource
- Examples
- Try it!
Lists an organization or source's findings.
To list across all sources provide a -
as the source id. Example: /v1/organizations/{organization_id}/sources/-/findings
HTTP request
GET https://securitycenter.googleapis.com/v1/{parent=organizations/*/sources/*}/findings
The URL uses gRPC Transcoding syntax.
Path parameters
Parameters | |
---|---|
parent |
Required. Name of the source the findings belong to. Its format is "organizations/[organization_id]/sources/[source_id]". To list across all sources provide a source_id of |
Query parameters
Parameters | |
---|---|
filter |
Expression that defines the filter to apply across findings. The expression is a list of one or more restrictions combined via logical operators Restrictions have the form
The supported operators are:
The supported value types are:
The following field and operator combinations are supported:
Usage: This should be milliseconds since epoch or an RFC3339 string. Examples: securityMarks.marks: For example, Use a partial match on the empty string to filter based on a property existing: Use a negated partial match on the empty string to filter based on a property not existing: |
orderBy |
Expression that defines what fields and order to use for sorting. The string value should follow SQL syntax: comma separated list of fields. For example: "name,resourceProperties.a_property". The default sorting order is ascending. To specify descending order for a field, a suffix " desc" should be appended to the field name. For example: "name desc,sourceProperties.a_property". Redundant space characters in the syntax are insignificant. "name desc,sourceProperties.a_property" and " name desc , sourceProperties.a_property " are equivalent. The following fields are supported: name parent state category resourceName eventTime sourceProperties securityMarks.marks |
readTime |
Time used as a reference point when filtering findings. The filter is limited to findings existing at the supplied time and their values are those at that specific time. Absence of this field will default to the API's version of NOW. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
compareDuration |
When compareDuration is set, the ListFindingsResult's "stateChange" attribute is updated to indicate whether the finding had its state changed, the finding's state remained unchanged, or if the finding was added in any state during the compareDuration period of time that precedes the readTime. This is the time between (readTime - compareDuration) and readTime. The stateChange value is derived based on the presence and state of the finding at the two points in time. Intermediate state changes between the two times don't affect the result. For example, the results aren't affected if the finding is made inactive and then active again. Possible "stateChange" values when compareDuration is specified:
If compareDuration is not specified, then the only possible stateChange is "UNUSED", which will be the stateChange set for all findings present at readTime. A duration in seconds with up to nine fractional digits, terminated by ' |
fieldMask |
A field mask to specify the Finding fields to be listed in the response. An empty field mask will list all fields. A comma-separated list of fully qualified names of fields. Example: |
pageToken |
The value returned by the last |
pageSize |
The maximum number of results to return in a single response. Default is 10, minimum is 1, maximum is 1000. |
Request body
The request body must be empty.
Response body
If successful, the response body contains data with the following structure:
Response message for listing findings.
JSON representation | |
---|---|
{
"listFindingsResults": [
{
object ( |
Fields | |
---|---|
listFindingsResults[] |
Findings matching the list request. |
readTime |
Time used for executing the list request. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
nextPageToken |
Token to retrieve the next page of results, or empty if there are no more results. |
totalSize |
The total number of findings matching the query. |
Authorization Scopes
Requires the following OAuth scope:
https://www.googleapis.com/auth/cloud-platform
For more information, see the Authentication Overview.
ListFindingsResult
Result containing the Finding and its StateChange.
JSON representation | |
---|---|
{ "finding": { object ( |
Fields | |
---|---|
finding |
Finding matching the search request. |
stateChange |
State change of the finding between the points in time. |
resource |
Output only. Resource that is associated with this finding. |
StateChange
The change in state of the finding.
When querying across two points in time this describes the change in the finding between the two points: CHANGED, UNCHANGED, ADDED, or REMOVED. Findings can not be deleted, so REMOVED implies that the finding at timestamp does not match the filter specified, but it did at timestamp - compareDuration. If there was no compareDuration supplied in the request the state change will be: UNUSED
Enums | |
---|---|
UNUSED |
State change is unused, this is the canonical default for this enum. |
CHANGED |
The finding has changed state in some way between the points in time and existed at both points. |
UNCHANGED |
The finding has not changed state between the points in time and existed at both points. |
ADDED |
The finding was created between the points in time. |
REMOVED |
The finding at timestamp does not match the filter specified, but it did at timestamp - compareDuration. |
Resource
Information related to the Google Cloud resource that is associated with this finding. LINT.IfChange
JSON representation | |
---|---|
{ "name": string, "projectName": string, "projectDisplayName": string, "parentName": string, "parentDisplayName": string } |
Fields | |
---|---|
name |
The full resource name of the resource. See: https://cloud.google.com/apis/design/resource_names#full_resource_name |
projectName |
The full resource name of project that the resource belongs to. |
projectDisplayName |
The human readable name of project that the resource belongs to. |
parentName |
The full resource name of resource's parent. |
parentDisplayName |
The human readable name of resource's parent. |