REST Resource: organizations.sources.findings

Resource: Finding

Security Command Center finding.

A finding is a record of assessment data like security, risk, health, or privacy, that is ingested into Security Command Center for presentation, notification, analysis, policy testing, and enforcement. For example, a cross-site scripting (XSS) vulnerability in an App Engine application is a finding.

JSON representation 
{
  "name": string,
  "parent": string,
  "resourceName": string,
  "state": enum (State),
  "category": string,
  "externalUri": string,
  "sourceProperties": {
    string: value,
    ...
  },
  "securityMarks": {
    object (SecurityMarks)
  },
  "eventTime": string,
  "createTime": string,
  "severity": enum (Severity),
  "canonicalName": string,
  "mute": enum (Mute),
  "findingClass": enum (FindingClass),
  "indicator": {
    object (Indicator)
  },
  "vulnerability": {
    object (Vulnerability)
  },
  "muteUpdateTime": string,
  "externalSystems": {
    string: {
      object (ExternalSystem)
    },
    ...
  },
  "mitreAttack": {
    object (MitreAttack)
  },
  "access": {
    object (Access)
  },
  "connections": [
    {
      object (Connection)
    }
  ],
  "muteInitiator": string,
  "muteInfo": {
    object (MuteInfo)
  },
  "processes": [
    {
      object (Process)
    }
  ],
  "contacts": {
    string: {
      object (ContactDetails)
    },
    ...
  },
  "compliances": [
    {
      object (Compliance)
    }
  ],
  "parentDisplayName": string,
  "description": string,
  "exfiltration": {
    object (Exfiltration)
  },
  "iamBindings": [
    {
      object (IamBinding)
    }
  ],
  "nextSteps": string,
  "moduleName": string,
  "containers": [
    {
      object (Container)
    }
  ],
  "kubernetes": {
    object (Kubernetes)
  },
  "database": {
    object (Database)
  },
  "attackExposure": {
    object (AttackExposure)
  },
  "files": [
    {
      object (File)
    }
  ],
  "cloudDlpInspection": {
    object (CloudDlpInspection)
  },
  "cloudDlpDataProfile": {
    object (CloudDlpDataProfile)
  },
  "kernelRootkit": {
    object (KernelRootkit)
  },
  "orgPolicies": [
    {
      object (OrgPolicy)
    }
  ],
  "application": {
    object (Application)
  },
  "backupDisasterRecovery": {
    object (BackupDisasterRecovery)
  },
  "securityPosture": {
    object (SecurityPosture)
  },
  "logEntries": [
    {
      object (LogEntry)
    }
  ],
  "loadBalancers": [
    {
      object (LoadBalancer)
    }
  ],
  "cloudArmor": {
    object (CloudArmor)
  },
  "notebook": {
    object (Notebook)
  },
  "toxicCombination": {
    object (ToxicCombination)
  },
  "groupMemberships": [
    {
      object (GroupMembership)
    }
  ],
  "dataAccessEvents": [
    {
      object (DataAccessEvent)
    }
  ],
  "dataFlowEvents": [
    {
      object (DataFlowEvent)
    }
  ]
}
Fields
name

string

The relative resource name of the finding. Example: "organizations/{organization_id}/sources/{source_id}/findings/{findingId}", "folders/{folder_id}/sources/{source_id}/findings/{findingId}", "projects/{projectId}/sources/{source_id}/findings/{findingId}".
parent

string

The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/{organization_id}/sources/{source_id}"
resourceName

string

For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time.
state

enum (State)

The state of the finding.
category

string

The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"
externalUri

string

The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.
sourceProperties

map (key: string, value: value (Value format))

Source specific properties. These properties are managed by the source that writes the finding. The key names in the sourceProperties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
securityMarks

object (SecurityMarks)

Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
eventTime

string (Timestamp format)

The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
createTime

string (Timestamp format)

The time at which the finding was created in Security Command Center.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
severity

enum (Severity)

The severity of the finding. This field is managed by the source that writes the finding.
canonicalName

string

The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}/findings/{findingId}", "folders/{folder_id}/sources/{source_id}/findings/{findingId}" or "projects/{project_number}/sources/{source_id}/findings/{findingId}", depending on the closest CRM ancestor of the resource associated with the finding.
mute

enum (Mute)

Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
findingClass

enum (FindingClass)

The class of the finding.
indicator

object (Indicator)

Represents what's commonly known as an indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. For more information, see Indicator of compromise.
vulnerability

object (Vulnerability)

Represents vulnerability-specific fields like CVE and CVSS scores. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
muteUpdateTime

string (Timestamp format)

Output only. The most recent time this finding was muted or unmuted.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
externalSystems

map (key: string, value: object (ExternalSystem))

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
mitreAttack

object (MitreAttack)

MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org
access

object (Access)

Access details associated with the finding, such as more information on the caller, which method was accessed, and from where.
connections[]

object (Connection)

Contains information about the IP connection associated with the finding.
muteInitiator

string

Records additional information about the mute operation, for example, the mute configuration that muted the finding and the user who muted the finding.
muteInfo

object (MuteInfo)

Output only. The mute information regarding this finding.
processes[]

object (Process)

Represents operating system processes associated with the Finding.
contacts

map (key: string, value: object (ContactDetails))

Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories

{
  "security": {
    "contacts": [
      {
        "email": "person1@company.com"
      },
      {
        "email": "person2@company.com"
      }
    ]
  }
}

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
compliances[]

object (Compliance)

Contains compliance information for security standards associated to the finding.
parentDisplayName

string

Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
description

string

Contains more details about the finding.
exfiltration

object (Exfiltration)

Represents exfiltrations associated with the finding.
iamBindings[]

object (IamBinding)

Represents IAM bindings associated with the finding.
nextSteps

string

Steps to address the finding.
moduleName

string

Unique identifier of the module which generated the finding. Example: folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885
containers[]

object (Container)

Containers associated with the finding. This field provides information for both Kubernetes and non-Kubernetes containers.
kubernetes

object (Kubernetes)

Kubernetes resources associated with the finding.
database

object (Database)

Database associated with the finding.
attackExposure

object (AttackExposure)

The results of an attack path simulation relevant to this finding.
files[]

object (File)

File associated with the finding.
cloudDlpInspection

object (CloudDlpInspection)

Cloud Data Loss Prevention (Cloud DLP) inspection results that are associated with the finding.
cloudDlpDataProfile

object (CloudDlpDataProfile)

Cloud DLP data profile that is associated with the finding.
kernelRootkit

object (KernelRootkit)

Signature of the kernel rootkit.
orgPolicies[]

object (OrgPolicy)

Contains information about the org policies associated with the finding.
application

object (Application)

Represents an application associated with the finding.
backupDisasterRecovery

object (BackupDisasterRecovery)

Fields related to Backup and DR findings.
securityPosture

object (SecurityPosture)

The security posture associated with the finding.
logEntries[]

object (LogEntry)

Log entries that are relevant to the finding.
loadBalancers[]

object (LoadBalancer)

The load balancers associated with the finding.
cloudArmor

object (CloudArmor)

Fields related to Cloud Armor findings.
notebook

object (Notebook)

Notebook associated with the finding.
toxicCombination

object (ToxicCombination)

Contains details about a group of security issues that, when the issues occur together, represent a greater risk than when the issues occur independently. A group of such issues is referred to as a toxic combination. This field cannot be updated. Its value is ignored in all update requests.
groupMemberships[]

object (GroupMembership)

Contains details about groups of which this finding is a member. A group is a collection of findings that are related in some way. This field cannot be updated. Its value is ignored in all update requests.
dataAccessEvents[]

object (DataAccessEvent)

Data access events associated with the finding.
dataFlowEvents[]

object (DataFlowEvent)

Data flow events associated with the finding.

State

The state of the finding.

Enums
STATE_UNSPECIFIED Unspecified state.
ACTIVE The finding requires attention and has not been addressed yet.
INACTIVE The finding has been fixed, triaged as a non-issue or otherwise addressed and is no longer active.

SecurityMarks

User specified security marks that are attached to the parent Security Command Center resource. Security marks are scoped within a Security Command Center organization -- they can be modified and viewed by all users who have proper permissions on the organization.

JSON representation 
{
  "name": string,
  "marks": {
    string: string,
    ...
  },
  "canonicalName": string
}
Fields
name

string

The relative resource name of the SecurityMarks. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Examples: "organizations/{organization_id}/assets/{asset_id}/securityMarks" "organizations/{organization_id}/sources/{source_id}/findings/{findingId}/securityMarks".
marks

map (key: string, value: string)

Mutable user specified security marks belonging to the parent resource. Constraints are as follows:

  • Keys and values are treated as case insensitive
  • Keys must be between 1 - 256 characters (inclusive)
  • Keys must be letters, numbers, underscores, or dashes
  • Values have leading and trailing whitespace trimmed, remaining characters must be between 1 - 4096 characters (inclusive)

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
canonicalName

string

The canonical name of the marks. Examples: "organizations/{organization_id}/assets/{asset_id}/securityMarks" "folders/{folder_id}/assets/{asset_id}/securityMarks" "projects/{project_number}/assets/{asset_id}/securityMarks" "organizations/{organization_id}/sources/{source_id}/findings/{findingId}/securityMarks" "folders/{folder_id}/sources/{source_id}/findings/{findingId}/securityMarks" "projects/{project_number}/sources/{source_id}/findings/{findingId}/securityMarks"

Severity

The severity of the finding.

Enums
SEVERITY_UNSPECIFIED This value is used for findings when a source doesn't write a severity value.
CRITICAL

Vulnerability: A critical vulnerability is easily discoverable by an external actor, exploitable, and results in the direct ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. Examples include publicly accessible unprotected user data and public SSH access with weak or no passwords.

Threat: Indicates a threat that is able to access, modify, or delete data or execute unauthorized code within existing resources.
HIGH

Vulnerability: A high risk vulnerability can be easily discovered and exploited in combination with other vulnerabilities in order to gain direct access and the ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. An example is a database with weak or no passwords that is only accessible internally. This database could easily be compromised by an actor that had access to the internal network.

Threat: Indicates a threat that is able to create new computational resources in an environment but not able to access data or execute code in existing resources.
MEDIUM

Vulnerability: A medium risk vulnerability could be used by an actor to gain access to resources or privileges that enable them to eventually (through multiple steps or a complex exploit) gain access and the ability to execute arbitrary code or exfiltrate data. An example is a service account with access to more projects than it should have. If an actor gains access to the service account, they could potentially use that access to manipulate a project the service account was not intended to.

Threat: Indicates a threat that is able to cause operational impact but may not access data or execute unauthorized code.
LOW

Vulnerability: A low risk vulnerability hampers a security organization's ability to detect vulnerabilities or active threats in their deployment, or prevents the root cause investigation of security issues. An example is monitoring and logs being disabled for resource configurations and access.

Threat: Indicates a threat that has obtained minimal access to an environment but is not able to access data, execute code, or create resources.

Mute

Mute state a finding can be in.

Enums
MUTE_UNSPECIFIED Unspecified.
MUTED Finding has been muted.
UNMUTED Finding has been unmuted.
UNDEFINED Finding has never been muted/unmuted.

FindingClass

Represents what kind of Finding it is.

Enums
FINDING_CLASS_UNSPECIFIED Unspecified finding class.
THREAT Describes unwanted or malicious activity.
VULNERABILITY Describes a potential weakness in software that increases risk to Confidentiality & Integrity & Availability.
MISCONFIGURATION Describes a potential weakness in cloud resource/asset configuration that increases risk.
OBSERVATION Describes a security observation that is for informational purposes.
SCC_ERROR Describes an error that prevents some SCC functionality.
POSTURE_VIOLATION Describes a potential security risk due to a change in the security posture.
TOXIC_COMBINATION Describes a group of security issues that, when the issues occur together, represent a greater risk than when the issues occur independently. A group of such issues is referred to as a toxic combination.
SENSITIVE_DATA_RISK Describes a potential security risk to data assets that contain sensitive data.

Indicator

Represents what's commonly known as an indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. For more information, see Indicator of compromise.

JSON representation 
{
  "ipAddresses": [
    string
  ],
  "domains": [
    string
  ],
  "signatures": [
    {
      object (ProcessSignature)
    }
  ],
  "uris": [
    string
  ]
}
Fields
ipAddresses[]

string

The list of IP addresses that are associated with the finding.
domains[]

string

List of domains associated to the Finding.
signatures[]

object (ProcessSignature)

The list of matched signatures indicating that the given process is present in the environment.
uris[]

string

The list of URIs associated to the Findings.

ProcessSignature

Indicates what signature matched this process.

JSON representation 
{
  "signatureType": enum (SignatureType),

  // Union field signature can be only one of the following:
  "memoryHashSignature": {
    object (MemoryHashSignature)
  },
  "yaraRuleSignature": {
    object (YaraRuleSignature)
  }
  // End of list of possible types for union field signature.
}
Fields
signatureType

enum (SignatureType)

Describes the type of resource associated with the signature.

Union field signature.

signature can be only one of the following:
memoryHashSignature

object (MemoryHashSignature)

Signature indicating that a binary family was matched.
yaraRuleSignature

object (YaraRuleSignature)

Signature indicating that a YARA rule was matched.

MemoryHashSignature

A signature corresponding to memory page hashes.

JSON representation 
{
  "binaryFamily": string,
  "detections": [
    {
      object (Detection)
    }
  ]
}
Fields
binaryFamily

string

The binary family.
detections[]

object (Detection)

The list of memory hash detections contributing to the binary family match.

Detection

Memory hash detection contributing to the binary family match.

JSON representation 
{
  "binary": string,
  "percentPagesMatched": number
}
Fields
binary

string

The name of the binary associated with the memory hash signature detection.
percentPagesMatched

number

The percentage of memory page hashes in the signature that were matched.

YaraRuleSignature

A signature corresponding to a YARA rule.

JSON representation 
{
  "yaraRule": string
}
Fields
yaraRule

string

The name of the YARA rule.

SignatureType

Possible resource types to be associated with a signature.

Enums
SIGNATURE_TYPE_UNSPECIFIED The default signature type.
SIGNATURE_TYPE_PROCESS Used for signatures concerning processes.
SIGNATURE_TYPE_FILE Used for signatures concerning disks.

Vulnerability

Refers to common vulnerability fields e.g. cve, cvss, cwe etc.

JSON representation 
{
  "cve": {
    object (Cve)
  },
  "offendingPackage": {
    object (Package)
  },
  "fixedPackage": {
    object (Package)
  },
  "securityBulletin": {
    object (SecurityBulletin)
  }
}
Fields
cve

object (Cve)

CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
offendingPackage

object (Package)

The offending package is relevant to the finding.
fixedPackage

object (Package)

The fixed package is relevant to the finding.
securityBulletin

object (SecurityBulletin)

The security bulletin is relevant to this finding.

Cve

CVE stands for Common Vulnerabilities and Exposures. Information from the CVE record that describes this vulnerability.

JSON representation 
{
  "id": string,
  "references": [
    {
      object (Reference)
    }
  ],
  "cvssv3": {
    object (Cvssv3)
  },
  "upstreamFixAvailable": boolean,
  "impact": enum (RiskRating),
  "exploitationActivity": enum (ExploitationActivity),
  "observedInTheWild": boolean,
  "zeroDay": boolean,
  "exploitReleaseDate": string,
  "firstExploitationDate": string
}
Fields
id

string

The unique identifier for the vulnerability. e.g. CVE-2021-34527
references[]

object (Reference)

Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
cvssv3

object (Cvssv3)

Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
upstreamFixAvailable

boolean

Whether upstream fix is available for the CVE.
impact

enum (RiskRating)

The potential impact of the vulnerability if it was to be exploited.
exploitationActivity

enum (ExploitationActivity)

The exploitation activity of the vulnerability in the wild.
observedInTheWild

boolean

Whether or not the vulnerability has been observed in the wild.
zeroDay

boolean

Whether or not the vulnerability was zero day when the finding was published.
exploitReleaseDate

string (Timestamp format)

Date the first publicly available exploit or PoC was released.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
firstExploitationDate

string (Timestamp format)

Date of the earliest known exploitation.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Reference

Additional Links

JSON representation 
{
  "source": string,
  "uri": string
}
Fields
source

string

Source of the reference e.g. NVD
uri

string

Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.

Cvssv3

Common Vulnerability Scoring System version 3.

JSON representation 
{
  "baseScore": number,
  "attackVector": enum (AttackVector),
  "attackComplexity": enum (AttackComplexity),
  "privilegesRequired": enum (PrivilegesRequired),
  "userInteraction": enum (UserInteraction),
  "scope": enum (Scope),
  "confidentialityImpact": enum (Impact),
  "integrityImpact": enum (Impact),
  "availabilityImpact": enum (Impact)
}
Fields
baseScore

number

The base score is a function of the base metric scores.
attackVector

enum (AttackVector)

Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
attackComplexity

enum (AttackComplexity)

This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.
privilegesRequired

enum (PrivilegesRequired)

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
userInteraction

enum (UserInteraction)

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
scope

enum (Scope)

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
confidentialityImpact

enum (Impact)

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
integrityImpact

enum (Impact)

This metric measures the impact to integrity of a successfully exploited vulnerability.
availabilityImpact

enum (Impact)

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

AttackVector

This metric reflects the context by which vulnerability exploitation is possible.

Enums
ATTACK_VECTOR_UNSPECIFIED Invalid value.
ATTACK_VECTOR_NETWORK The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet.
ATTACK_VECTOR_ADJACENT The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology.
ATTACK_VECTOR_LOCAL The vulnerable component is not bound to the network stack and the attacker's path is via read/write/execute capabilities.
ATTACK_VECTOR_PHYSICAL The attack requires the attacker to physically touch or manipulate the vulnerable component.

AttackComplexity

This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.

Enums
ATTACK_COMPLEXITY_UNSPECIFIED Invalid value.
ATTACK_COMPLEXITY_LOW Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.
ATTACK_COMPLEXITY_HIGH A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.

PrivilegesRequired

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

Enums
PRIVILEGES_REQUIRED_UNSPECIFIED Invalid value.
PRIVILEGES_REQUIRED_NONE The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
PRIVILEGES_REQUIRED_LOW The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
PRIVILEGES_REQUIRED_HIGH The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable component allowing access to component-wide settings and files.

UserInteraction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

Enums
USER_INTERACTION_UNSPECIFIED Invalid value.
USER_INTERACTION_NONE The vulnerable system can be exploited without interaction from any user.
USER_INTERACTION_REQUIRED Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.

Scope

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Enums
SCOPE_UNSPECIFIED Invalid value.
SCOPE_UNCHANGED An exploited vulnerability can only affect resources managed by the same security authority.
SCOPE_CHANGED An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component.

Impact

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack.

Enums
IMPACT_UNSPECIFIED Invalid value.
IMPACT_HIGH High impact.
IMPACT_LOW Low impact.
IMPACT_NONE No impact.

RiskRating

The possible values of impact of the vulnerability if it was to be exploited.

Enums
RISK_RATING_UNSPECIFIED Invalid or empty value.
LOW Exploitation would have little to no security impact.
MEDIUM Exploitation would enable attackers to perform activities, or could allow attackers to have a direct impact, but would require additional steps.
HIGH Exploitation would enable attackers to have a notable direct impact without needing to overcome any major mitigating factors.
CRITICAL Exploitation would fundamentally undermine the security of affected systems, enable actors to perform significant attacks with minimal effort, with little to no mitigating factors to overcome.

ExploitationActivity

The possible values of exploitation activity of the vulnerability in the wild.

Enums
EXPLOITATION_ACTIVITY_UNSPECIFIED Invalid or empty value.
WIDE Exploitation has been reported or confirmed to widely occur.
CONFIRMED Limited reported or confirmed exploitation activities.
AVAILABLE Exploit is publicly available.
ANTICIPATED No known exploitation activity, but has a high potential for exploitation.
NO_KNOWN No known exploitation activity.

Package

Package is a generic definition of a package.

JSON representation 
{
  "packageName": string,
  "cpeUri": string,
  "packageType": string,
  "packageVersion": string
}
Fields
packageName

string

The name of the package where the vulnerability was detected.
cpeUri

string

The CPE URI where the vulnerability was detected.
packageType

string

Type of package, for example, os, maven, or go.
packageVersion

string

The version of the package.

SecurityBulletin

SecurityBulletin are notifications of vulnerabilities of Google products.

JSON representation 
{
  "bulletinId": string,
  "submissionTime": string,
  "suggestedUpgradeVersion": string
}
Fields
bulletinId

string

ID of the bulletin corresponding to the vulnerability.
submissionTime

string (Timestamp format)

Submission time of this Security Bulletin.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
suggestedUpgradeVersion

string

This represents a version that the cluster receiving this notification should be upgraded to, based on its current version. For example, 1.15.0

ExternalSystem

Representation of third party SIEM/SOAR fields within SCC.

JSON representation 
{
  "name": string,
  "assignees": [
    string
  ],
  "externalUid": string,
  "status": string,
  "externalSystemUpdateTime": string,
  "caseUri": string,
  "casePriority": string,
  "caseSla": string,
  "caseCreateTime": string,
  "caseCloseTime": string,
  "ticketInfo": {
    object (TicketInfo)
  }
}
Fields
name

string

Full resource name of the external system, for example: "organizations/1234/sources/5678/findings/123456/externalSystems/jira", "folders/1234/sources/5678/findings/123456/externalSystems/jira", "projects/1234/sources/5678/findings/123456/externalSystems/jira"
assignees[]

string

References primary/secondary etc assignees in the external system.
externalUid

string

The identifier that's used to track the finding's corresponding case in the external system.
status

string

The most recent status of the finding's corresponding case, as reported by the external system.
externalSystemUpdateTime

string (Timestamp format)

The time when the case was last updated, as reported by the external system.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
caseUri

string

The link to the finding's corresponding case in the external system.
casePriority

string

The priority of the finding's corresponding case in the external system.
caseSla

string (Timestamp format)

The SLA of the finding's corresponding case in the external system.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
caseCreateTime

string (Timestamp format)

The time when the case was created, as reported by the external system.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
caseCloseTime

string (Timestamp format)

The time when the case was closed, as reported by the external system.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
ticketInfo

object (TicketInfo)

Information about the ticket, if any, that is being used to track the resolution of the issue that is identified by this finding.

TicketInfo

Information about the ticket, if any, that is being used to track the resolution of the issue that is identified by this finding.

JSON representation 
{
  "id": string,
  "assignee": string,
  "description": string,
  "uri": string,
  "status": string,
  "updateTime": string
}
Fields
id

string

The identifier of the ticket in the ticket system.
assignee

string

The assignee of the ticket in the ticket system.
description

string

The description of the ticket in the ticket system.
uri

string

The link to the ticket in the ticket system.
status

string

The latest status of the ticket, as reported by the ticket system.
updateTime

string (Timestamp format)

The time when the ticket was last updated, as reported by the ticket system.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

MitreAttack

MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org

JSON representation 
{
  "primaryTactic": enum (Tactic),
  "primaryTechniques": [
    enum (Technique)
  ],
  "additionalTactics": [
    enum (Tactic)
  ],
  "additionalTechniques": [
    enum (Technique)
  ],
  "version": string
}
Fields
primaryTactic

enum (Tactic)

The MITRE ATT&CK tactic most closely represented by this finding, if any.
primaryTechniques[]

enum (Technique)

The MITRE ATT&CK technique most closely represented by this finding, if any. primaryTechniques is a repeated field because there are multiple levels of MITRE ATT&CK techniques. If the technique most closely represented by this finding is a sub-technique (e.g. SCANNING_IP_BLOCKS), both the sub-technique and its parent technique(s) will be listed (e.g. SCANNING_IP_BLOCKS, ACTIVE_SCANNING).
additionalTactics[]

enum (Tactic)

Additional MITRE ATT&CK tactics related to this finding, if any.
additionalTechniques[]

enum (Technique)

Additional MITRE ATT&CK techniques related to this finding, if any, along with any of their respective parent techniques.
version

string

The MITRE ATT&CK version referenced by the above fields. E.g. "8".

Tactic

MITRE ATT&CK tactics that can be referenced by SCC findings. See: https://attack.mitre.org/tactics/enterprise/

Enums
TACTIC_UNSPECIFIED Unspecified value.
RECONNAISSANCE TA0043
RESOURCE_DEVELOPMENT TA0042
INITIAL_ACCESS TA0001
EXECUTION TA0002
PERSISTENCE TA0003
PRIVILEGE_ESCALATION TA0004
DEFENSE_EVASION TA0005
CREDENTIAL_ACCESS TA0006
DISCOVERY TA0007
LATERAL_MOVEMENT TA0008
COLLECTION TA0009
COMMAND_AND_CONTROL TA0011
EXFILTRATION TA0010
IMPACT TA0040

Technique

MITRE ATT&CK techniques that can be referenced by SCC findings. See: https://attack.mitre.org/techniques/enterprise/ Next ID: 65

Enums
TECHNIQUE_UNSPECIFIED Unspecified value.
MASQUERADING T1036
MATCH_LEGITIMATE_NAME_OR_LOCATION T1036.005
BOOT_OR_LOGON_INITIALIZATION_SCRIPTS T1037
STARTUP_ITEMS T1037.005
NETWORK_SERVICE_DISCOVERY T1046
PROCESS_DISCOVERY T1057
COMMAND_AND_SCRIPTING_INTERPRETER T1059
UNIX_SHELL T1059.004
PYTHON T1059.006
EXPLOITATION_FOR_PRIVILEGE_ESCALATION T1068
PERMISSION_GROUPS_DISCOVERY T1069
CLOUD_GROUPS T1069.003
INDICATOR_REMOVAL_FILE_DELETION T1070.004
APPLICATION_LAYER_PROTOCOL T1071
DNS T1071.004
SOFTWARE_DEPLOYMENT_TOOLS T1072
VALID_ACCOUNTS T1078
DEFAULT_ACCOUNTS T1078.001
LOCAL_ACCOUNTS T1078.003
CLOUD_ACCOUNTS T1078.004
PROXY T1090
EXTERNAL_PROXY T1090.002
MULTI_HOP_PROXY T1090.003
ACCOUNT_MANIPULATION T1098
ADDITIONAL_CLOUD_CREDENTIALS T1098.001
SSH_AUTHORIZED_KEYS T1098.004
ADDITIONAL_CONTAINER_CLUSTER_ROLES T1098.006
INGRESS_TOOL_TRANSFER T1105
NATIVE_API T1106
BRUTE_FORCE T1110
SHARED_MODULES T1129
ACCESS_TOKEN_MANIPULATION T1134
TOKEN_IMPERSONATION_OR_THEFT T1134.001
EXPLOIT_PUBLIC_FACING_APPLICATION T1190
DOMAIN_POLICY_MODIFICATION T1484
DATA_DESTRUCTION T1485
SERVICE_STOP T1489
INHIBIT_SYSTEM_RECOVERY T1490
RESOURCE_HIJACKING T1496
NETWORK_DENIAL_OF_SERVICE T1498
CLOUD_SERVICE_DISCOVERY T1526
STEAL_APPLICATION_ACCESS_TOKEN T1528
ACCOUNT_ACCESS_REMOVAL T1531
CREATE_OR_MODIFY_SYSTEM_PROCESS T1543
ABUSE_ELEVATION_CONTROL_MECHANISM T1548
UNSECURED_CREDENTIALS T1552
MODIFY_AUTHENTICATION_PROCESS T1556
IMPAIR_DEFENSES T1562
DISABLE_OR_MODIFY_TOOLS T1562.001
EXFILTRATION_OVER_WEB_SERVICE T1567
EXFILTRATION_TO_CLOUD_STORAGE T1567.002
DYNAMIC_RESOLUTION T1568
LATERAL_TOOL_TRANSFER T1570
MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE T1578
CREATE_SNAPSHOT T1578.001
CLOUD_INFRASTRUCTURE_DISCOVERY T1580
OBTAIN_CAPABILITIES T1588
ACTIVE_SCANNING T1595
SCANNING_IP_BLOCKS T1595.001
CONTAINER_ADMINISTRATION_COMMAND T1609
ESCAPE_TO_HOST T1611
CONTAINER_AND_RESOURCE_DISCOVERY T1613
STEAL_OR_FORGE_AUTHENTICATION_CERTIFICATES T1649

Access

Represents an access event.

JSON representation 
{
  "principalEmail": string,
  "callerIp": string,
  "callerIpGeo": {
    object (Geolocation)
  },
  "userAgentFamily": string,
  "userAgent": string,
  "serviceName": string,
  "methodName": string,
  "principalSubject": string,
  "serviceAccountKeyName": string,
  "serviceAccountDelegationInfo": [
    {
      object (ServiceAccountDelegationInfo)
    }
  ],
  "userName": string
}
Fields
principalEmail

string

Associated email, such as "foo@google.com".

The email address of the authenticated user or a service account acting on behalf of a third party principal making the request. For third party identity callers, the principalSubject field is populated instead of this field. For privacy reasons, the principal email address is sometimes redacted. For more information, see Caller identities in audit logs.
callerIp

string

Caller's IP address, such as "1.1.1.1".
callerIpGeo

object (Geolocation)

The caller IP's geolocation, which identifies where the call came from.
userAgentFamily

string

Type of user agent associated with the finding. For example, an operating system shell or an embedded or standalone application.
userAgent

string

The caller's user agent string associated with the finding.
serviceName

string

This is the API service that the service account made a call to, e.g. "iam.googleapis.com"
methodName

string

The method that the service account called, e.g. "SetIamPolicy".
principalSubject

string

A string that represents the principalSubject that is associated with the identity. Unlike principalEmail, principalSubject supports principals that aren't associated with email addresses, such as third party principals. For most identities, the format is principal://iam.googleapis.com/{identity pool name}/subject/{subject}. Some GKE identities, such as GKE_WORKLOAD, FREEFORM, and GKE_HUB_WORKLOAD, still use the legacy format serviceAccount:{identity pool name}[{subject}].
serviceAccountKeyName

string

The name of the service account key that was used to create or exchange credentials when authenticating the service account that made the request. This is a scheme-less URI full resource name. For example:

"//iam.googleapis.com/projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}".
serviceAccountDelegationInfo[]

object (ServiceAccountDelegationInfo)

The identity delegation history of an authenticated service account that made the request. The serviceAccountDelegationInfo[] object contains information about the real authorities that try to access Google Cloud resources by delegating on a service account. When multiple authorities are present, they are guaranteed to be sorted based on the original ordering of the identity delegation events.
userName

string

A string that represents a username. The username provided depends on the type of the finding and is likely not an IAM principal. For example, this can be a system username if the finding is related to a virtual machine, or it can be an application login username.

Geolocation

Represents a geographical location for a given access.

JSON representation 
{
  "regionCode": string
}
Fields
regionCode

string

A CLDR.

ServiceAccountDelegationInfo

Identity delegation history of an authenticated service account.

JSON representation 
{
  "principalEmail": string,
  "principalSubject": string
}
Fields
principalEmail

string

The email address of a Google account.
principalSubject

string

A string representing the principalSubject associated with the identity. As compared to principalEmail, supports principals that aren't associated with email addresses, such as third party principals. For most identities, the format will be principal://iam.googleapis.com/{identity pool name}/subjects/{subject} except for some GKE identities (GKE_WORKLOAD, FREEFORM, GKE_HUB_WORKLOAD) that are still in the legacy format serviceAccount:{identity pool name}[{subject}]

Connection

Contains information about the IP connection associated with the finding.

JSON representation 
{
  "destinationIp": string,
  "destinationPort": integer,
  "sourceIp": string,
  "sourcePort": integer,
  "protocol": enum (Protocol)
}
Fields
destinationIp

string

Destination IP address. Not present for sockets that are listening and not connected.
destinationPort

integer

Destination port. Not present for sockets that are listening and not connected.
sourceIp

string

Source IP address.
sourcePort

integer

Source port.
protocol

enum (Protocol)

IANA Internet Protocol Number such as TCP(6) and UDP(17).

Protocol

IANA Internet Protocol Number such as TCP(6) and UDP(17).

Enums
PROTOCOL_UNSPECIFIED Unspecified protocol (not HOPOPT).
ICMP Internet Control Message Protocol.
TCP Transmission Control Protocol.
UDP User Datagram Protocol.
GRE Generic Routing Encapsulation.
ESP Encap Security Payload.

MuteInfo

Mute information about the finding, including whether the finding has a static mute or any matching dynamic mute rules.

JSON representation 
{
  "staticMute": {
    object (StaticMute)
  },
  "dynamicMuteRecords": [
    {
      object (DynamicMuteRecord)
    }
  ]
}
Fields
staticMute

object (StaticMute)

If set, the static mute applied to this finding. Static mutes override dynamic mutes. If unset, there is no static mute.
dynamicMuteRecords[]

object (DynamicMuteRecord)

The list of dynamic mute rules that currently match the finding.

StaticMute

Information about the static mute state. A static mute state overrides any dynamic mute rules that apply to this finding. The static mute state can be set by a static mute rule or by muting the finding directly.

JSON representation 
{
  "state": enum (Mute),
  "applyTime": string
}
Fields
state

enum (Mute)

The static mute state. If the value is MUTED or UNMUTED, then the finding's overall mute state will have the same value.
applyTime

string (Timestamp format)

When the static mute was applied.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

DynamicMuteRecord

The record of a dynamic mute rule that matches the finding.

JSON representation 
{
  "muteConfig": string,
  "matchTime": string
}
Fields
muteConfig

string

The relative resource name of the mute rule, represented by a mute config, that created this record, for example organizations/123/muteConfigs/mymuteconfig or organizations/123/locations/global/muteConfigs/mymuteconfig.
matchTime

string (Timestamp format)

When the dynamic mute rule first matched the finding.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Process

Represents an operating system process.

JSON representation 
{
  "name": string,
  "binary": {
    object (File)
  },
  "libraries": [
    {
      object (File)
    }
  ],
  "script": {
    object (File)
  },
  "args": [
    string
  ],
  "argumentsTruncated": boolean,
  "envVariables": [
    {
      object (EnvironmentVariable)
    }
  ],
  "envVariablesTruncated": boolean,
  "pid": string,
  "parentPid": string
}
Fields
name

string

The process name, as displayed in utilities like top and ps. This name can be accessed through /proc/[pid]/comm and changed with prctl(PR_SET_NAME).
binary

object (File)

File information for the process executable.
libraries[]

object (File)

File information for libraries loaded by the process.
script

object (File)

When the process represents the invocation of a script, binary provides information about the interpreter, while script provides information about the script file provided to the interpreter.
args[]

string

Process arguments as JSON encoded strings.
argumentsTruncated

boolean

True if args is incomplete.
envVariables[]

object (EnvironmentVariable)

Process environment variables.
envVariablesTruncated

boolean

True if envVariables is incomplete.
pid

string (int64 format)

The process ID.
parentPid

string (int64 format)

The parent process ID.

File

File information about the related binary/library used by an executable, or the script used by a script interpreter

JSON representation 
{
  "path": string,
  "size": string,
  "sha256": string,
  "hashedSize": string,
  "partiallyHashed": boolean,
  "contents": string,
  "diskPath": {
    object (DiskPath)
  }
}
Fields
path

string

Absolute path of the file as a JSON encoded string.
size

string (int64 format)

Size of the file in bytes.
sha256

string

SHA256 hash of the first hashedSize bytes of the file encoded as a hex string. If hashedSize == size, sha256 represents the SHA256 hash of the entire file.
hashedSize

string (int64 format)

The length in bytes of the file prefix that was hashed. If hashedSize == size, any hashes reported represent the entire file.
partiallyHashed

boolean

True when the hash covers only a prefix of the file.
contents

string

Prefix of the file contents as a JSON-encoded string.
diskPath

object (DiskPath)

Path of the file in terms of underlying disk/partition identifiers.

DiskPath

Path of the file in terms of underlying disk/partition identifiers.

JSON representation 
{
  "partitionUuid": string,
  "relativePath": string
}
Fields
partitionUuid

string

UUID of the partition (format https://wiki.archlinux.org/title/persistent_block_device_naming#by-uuid)
relativePath

string

Relative path of the file in the partition as a JSON encoded string. Example: /home/user1/executable_file.sh

EnvironmentVariable

A name-value pair representing an environment variable used in an operating system process.

JSON representation 
{
  "name": string,
  "val": string
}
Fields
name

string

Environment variable name as a JSON encoded string.
val

string

Environment variable value as a JSON encoded string.

ContactDetails

Details about specific contacts

JSON representation 
{
  "contacts": [
    {
      object (Contact)
    }
  ]
}
Fields
contacts[]

object (Contact)

A list of contacts

Contact

The email address of a contact.

JSON representation 
{
  "email": string
}
Fields
email

string

An email address. For example, "person123@company.com".

Compliance

Contains compliance information about a security standard indicating unmet recommendations.

JSON representation 
{
  "standard": string,
  "version": string,
  "ids": [
    string
  ]
}
Fields
standard

string

Industry-wide compliance standards or benchmarks, such as CIS, PCI, and OWASP.
version

string

Version of the standard or benchmark, for example, 1.1
ids[]

string

Policies within the standard or benchmark, for example, A.12.4.1

Exfiltration

Exfiltration represents a data exfiltration attempt from one or more sources to one or more targets. The sources attribute lists the sources of the exfiltrated data. The targets attribute lists the destinations the data was copied to.

JSON representation 
{
  "sources": [
    {
      object (ExfilResource)
    }
  ],
  "targets": [
    {
      object (ExfilResource)
    }
  ],
  "totalExfiltratedBytes": string
}
Fields
sources[]

object (ExfilResource)

If there are multiple sources, then the data is considered "joined" between them. For instance, BigQuery can join multiple tables, and each table would be considered a source.
targets[]

object (ExfilResource)

If there are multiple targets, each target would get a complete copy of the "joined" source data.
totalExfiltratedBytes

string (int64 format)

Total exfiltrated bytes processed for the entire job.

ExfilResource

Resource where data was exfiltrated from or exfiltrated to.

JSON representation 
{
  "name": string,
  "components": [
    string
  ]
}
Fields
name

string

The resource's full resource name.
components[]

string

Subcomponents of the asset that was exfiltrated, like URIs used during exfiltration, table names, databases, and filenames. For example, multiple tables might have been exfiltrated from the same Cloud SQL instance, or multiple files might have been exfiltrated from the same Cloud Storage bucket.

IamBinding

Represents a particular IAM binding, which captures a member's role addition, removal, or state.

JSON representation 
{
  "action": enum (Action),
  "role": string,
  "member": string
}
Fields
action

enum (Action)

The action that was performed on a Binding.
role

string

Role that is assigned to "members". For example, "roles/viewer", "roles/editor", or "roles/owner".
member

string

A single identity requesting access for a Cloud Platform resource, for example, "foo@google.com".

Action

The type of action performed on a Binding in a policy.

Enums
ACTION_UNSPECIFIED Unspecified.
ADD Addition of a Binding.
REMOVE Removal of a Binding.

Container

Container associated with the finding.

JSON representation 
{
  "name": string,
  "uri": string,
  "imageId": string,
  "labels": [
    {
      object (Label)
    }
  ],
  "createTime": string
}
Fields
name

string

Name of the container.
uri

string

Container image URI provided when configuring a pod or container. This string can identify a container image version using mutable tags.
imageId

string

Optional container image ID, if provided by the container runtime. Uniquely identifies the container image launched using a container image digest.
labels[]

object (Label)

Container labels, as provided by the container runtime.
createTime

string (Timestamp format)

The time that the container was created.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Label

Represents a generic name-value label. A label has separate name and value fields to support filtering with the contains() function. For more information, see Filtering on array-type fields.

JSON representation 
{
  "name": string,
  "value": string
}
Fields
name

string

Name of the label.
value

string

Value that corresponds to the label's name.

Kubernetes

Kubernetes-related attributes.

JSON representation 
{
  "pods": [
    {
      object (Pod)
    }
  ],
  "nodes": [
    {
      object (Node)
    }
  ],
  "nodePools": [
    {
      object (NodePool)
    }
  ],
  "roles": [
    {
      object (Role)
    }
  ],
  "bindings": [
    {
      object (Binding)
    }
  ],
  "accessReviews": [
    {
      object (AccessReview)
    }
  ],
  "objects": [
    {
      object (Object)
    }
  ]
}
Fields
pods[]

object (Pod)

Kubernetes Pods associated with the finding. This field contains Pod records for each container that is owned by a Pod.
nodes[]

object (Node)

Provides Kubernetes node information.
nodePools[]

object (NodePool)

GKE node pools associated with the finding. This field contains node pool information for each node, when it is available.
roles[]

object (Role)

Provides Kubernetes role information for findings that involve Roles or ClusterRoles.
bindings[]

object (Binding)

Provides Kubernetes role binding information for findings that involve RoleBindings or ClusterRoleBindings.
accessReviews[]

object (AccessReview)

Provides information on any Kubernetes access reviews (privilege checks) relevant to the finding.
objects[]

object (Object)

Kubernetes objects related to the finding.

Pod

A Kubernetes Pod.

JSON representation 
{
  "ns": string,
  "name": string,
  "labels": [
    {
      object (Label)
    }
  ],
  "containers": [
    {
      object (Container)
    }
  ]
}
Fields
ns

string

Kubernetes Pod namespace.
name

string

Kubernetes Pod name.
labels[]

object (Label)

Pod labels. For Kubernetes containers, these are applied to the container.
containers[]

object (Container)

Pod containers associated with this finding, if any.

Node

Kubernetes nodes associated with the finding.

JSON representation 
{
  "name": string
}
Fields
name

string

Full resource name of the Compute Engine VM running the cluster node.

NodePool

Provides GKE node pool information.

JSON representation 
{
  "name": string,
  "nodes": [
    {
      object (Node)
    }
  ]
}
Fields
name

string

Kubernetes node pool name.
nodes[]

object (Node)

Nodes associated with the finding.

Role

Kubernetes Role or ClusterRole.

JSON representation 
{
  "kind": enum (Kind),
  "ns": string,
  "name": string
}
Fields
kind

enum (Kind)

Role type.
ns

string

Role namespace.
name

string

Role name.

Kind

Types of Kubernetes roles.

Enums
KIND_UNSPECIFIED Role type is not specified.
ROLE Kubernetes Role.
CLUSTER_ROLE Kubernetes ClusterRole.

Binding

Represents a Kubernetes RoleBinding or ClusterRoleBinding.

JSON representation 
{
  "ns": string,
  "name": string,
  "role": {
    object (Role)
  },
  "subjects": [
    {
      object (Subject)
    }
  ]
}
Fields
ns

string

Namespace for the binding.
name

string

Name for the binding.
role

object (Role)

The Role or ClusterRole referenced by the binding.
subjects[]

object (Subject)

Represents one or more subjects that are bound to the role. Not always available for PATCH requests.

Subject

Represents a Kubernetes subject.

JSON representation 
{
  "kind": enum (AuthType),
  "ns": string,
  "name": string
}
Fields
kind

enum (AuthType)

Authentication type for the subject.
ns

string

Namespace for the subject.
name

string

Name for the subject.

AuthType

Auth types that can be used for the subject's kind field.

Enums
AUTH_TYPE_UNSPECIFIED Authentication is not specified.
USER User with valid certificate.
SERVICEACCOUNT Users managed by Kubernetes API with credentials stored as secrets.
GROUP Collection of users.

AccessReview

Conveys information about a Kubernetes access review (such as one returned by a kubectl auth can-i command) that was involved in a finding.

JSON representation 
{
  "group": string,
  "ns": string,
  "name": string,
  "resource": string,
  "subresource": string,
  "verb": string,
  "version": string
}
Fields
group

string

The API group of the resource. "*" means all.
ns

string

Namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces. Both are represented by "" (empty).
name

string

The name of the resource being requested. Empty means all.
resource

string

The optional resource type requested. "*" means all.
subresource

string

The optional subresource type.
verb

string

A Kubernetes resource API verb, like get, list, watch, create, update, delete, proxy. "*" means all.
version

string

The API version of the resource. "*" means all.

Object

Kubernetes object related to the finding, uniquely identified by GKNN. Used if the object Kind is not one of Pod, Node, NodePool, Binding, or AccessReview.

JSON representation 
{
  "group": string,
  "kind": string,
  "ns": string,
  "name": string,
  "containers": [
    {
      object (Container)
    }
  ]
}
Fields
group

string

Kubernetes object group, such as "policy.k8s.io/v1".
kind

string

Kubernetes object kind, such as "Namespace".
ns

string

Kubernetes object namespace. Must be a valid DNS label. Named "ns" to avoid collision with C++ namespace keyword. For details see https://kubernetes.io/docs/tasks/administer-cluster/namespaces/.
name

string

Kubernetes object name. For details see https://kubernetes.io/docs/concepts/overview/working-with-objects/names/.
containers[]

object (Container)

Pod containers associated with this finding, if any.

Database

Represents database access information, such as queries. A database may be a sub-resource of an instance (as in the case of Cloud SQL instances or Cloud Spanner instances), or the database instance itself. Some database resources might not have the full resource name populated because these resource types, such as Cloud SQL databases, are not yet supported by Cloud Asset Inventory. In these cases only the display name is provided.

JSON representation 
{
  "name": string,
  "displayName": string,
  "userName": string,
  "query": string,
  "grantees": [
    string
  ],
  "version": string
}
Fields
name

string

Some database resources may not have the full resource name populated because these resource types are not yet supported by Cloud Asset Inventory (e.g. Cloud SQL databases). In these cases only the display name will be provided. The full resource name of the database that the user connected to, if it is supported by Cloud Asset Inventory.
displayName

string

The human-readable name of the database that the user connected to.
userName

string

The username used to connect to the database. The username might not be an IAM principal and does not have a set format.
query

string

The SQL statement that is associated with the database access.
grantees[]

string

The target usernames, roles, or groups of an SQL privilege grant, which is not an IAM policy change.
version

string

The version of the database, for example, POSTGRES_14. See the complete list.

AttackExposure

An attack exposure contains the results of an attack path simulation run.

JSON representation 
{
  "score": number,
  "latestCalculationTime": string,
  "attackExposureResult": string,
  "state": enum (State),
  "exposedHighValueResourcesCount": integer,
  "exposedMediumValueResourcesCount": integer,
  "exposedLowValueResourcesCount": integer
}
Fields
score

number

A number between 0 (inclusive) and infinity that represents how important this finding is to remediate. The higher the score, the more important it is to remediate.
latestCalculationTime

string (Timestamp format)

The most recent time the attack exposure was updated on this finding.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
attackExposureResult

string

The resource name of the attack path simulation result that contains the details regarding this attack exposure score. Example: organizations/123/simulations/456/attackExposureResults/789
state

enum (State)

What state this AttackExposure is in. This captures whether or not an attack exposure has been calculated or not.
exposedHighValueResourcesCount

integer

The number of high value resources that are exposed as a result of this finding.
exposedMediumValueResourcesCount

integer

The number of medium value resources that are exposed as a result of this finding.
exposedLowValueResourcesCount

integer

The number of high value resources that are exposed as a result of this finding.

State

This enum defines the various states an AttackExposure can be in.

Enums
STATE_UNSPECIFIED The state is not specified.
CALCULATED The attack exposure has been calculated.
NOT_CALCULATED The attack exposure has not been calculated.

CloudDlpInspection

Details about the Cloud Data Loss Prevention (Cloud DLP) inspection job that produced the finding.

JSON representation 
{
  "inspectJob": string,
  "infoType": string,
  "infoTypeCount": string,
  "fullScan": boolean
}
Fields
inspectJob

string

Name of the inspection job, for example, projects/123/locations/europe/dlpJobs/i-8383929.
infoType

string

The type of information (or infoType) found, for example, EMAIL_ADDRESS or STREET_ADDRESS.
infoTypeCount

string (int64 format)

The number of times Cloud DLP found this infoType within this job and resource.
fullScan

boolean

Whether Cloud DLP scanned the complete resource or a sampled subset.

CloudDlpDataProfile

The data profile associated with the finding.

JSON representation 
{
  "dataProfile": string,
  "parentType": enum (ParentType)
}
Fields
dataProfile

string

Name of the data profile, for example, projects/123/locations/europe/tableProfiles/8383929.
parentType

enum (ParentType)

The resource hierarchy level at which the data profile was generated.

ParentType

Parents for configurations that produce data profile findings.

Enums
PARENT_TYPE_UNSPECIFIED Unspecified parent type.
ORGANIZATION Organization-level configurations.
PROJECT Project-level configurations.

KernelRootkit

Kernel mode rootkit signatures.

JSON representation 
{
  "name": string,
  "unexpectedCodeModification": boolean,
  "unexpectedReadOnlyDataModification": boolean,
  "unexpectedFtraceHandler": boolean,
  "unexpectedKprobeHandler": boolean,
  "unexpectedKernelCodePages": boolean,
  "unexpectedSystemCallHandler": boolean,
  "unexpectedInterruptHandler": boolean,
  "unexpectedProcessesInRunqueue": boolean
}
Fields
name

string

Rootkit name, when available.
unexpectedCodeModification

boolean

True if unexpected modifications of kernel code memory are present.
unexpectedReadOnlyDataModification

boolean

True if unexpected modifications of kernel read-only data memory are present.
unexpectedFtraceHandler

boolean

True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.
unexpectedKprobeHandler

boolean

True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.
unexpectedKernelCodePages

boolean

True if kernel code pages that are not in the expected kernel or module code regions are present.
unexpectedSystemCallHandler

boolean

True if system call handlers that are are not in the expected kernel or module code regions are present.
unexpectedInterruptHandler

boolean

True if interrupt handlers that are are not in the expected kernel or module code regions are present.
unexpectedProcessesInRunqueue

boolean

True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

OrgPolicy

Contains information about the org policies associated with the finding.

JSON representation 
{
  "name": string
}
Fields
name

string

The resource name of the org policy. Example: "organizations/{organization_id}/policies/{constraint_name}"

Application

Represents an application associated with a finding.

JSON representation 
{
  "baseUri": string,
  "fullUri": string
}
Fields
baseUri

string

The base URI that identifies the network location of the application in which the vulnerability was detected. For example, http://example.com.
fullUri

string

The full URI with payload that can be used to reproduce the vulnerability. For example, http://example.com?p=aMmYgI6H.

BackupDisasterRecovery

Information related to Google Cloud Backup and DR Service findings.

JSON representation 
{
  "backupTemplate": string,
  "policies": [
    string
  ],
  "host": string,
  "applications": [
    string
  ],
  "storagePool": string,
  "policyOptions": [
    string
  ],
  "profile": string,
  "appliance": string,
  "backupType": string,
  "backupCreateTime": string
}
Fields
backupTemplate

string

The name of a Backup and DR template which comprises one or more backup policies. See the Backup and DR documentation for more information. For example, snap-ov.
policies[]

string

The names of Backup and DR policies that are associated with a template and that define when to run a backup, how frequently to run a backup, and how long to retain the backup image. For example, onvaults.
host

string

The name of a Backup and DR host, which is managed by the backup and recovery appliance and known to the management console. The host can be of type Generic (for example, Compute Engine, SQL Server, Oracle DB, SMB file system, etc.), vCenter, or an ESX server. See the Backup and DR documentation on hosts for more information. For example, centos7-01.
applications[]

string

The names of Backup and DR applications. An application is a VM, database, or file system on a managed host monitored by a backup and recovery appliance. For example, centos7-01-vol00, centos7-01-vol01, centos7-01-vol02.
storagePool

string

The name of the Backup and DR storage pool that the backup and recovery appliance is storing data in. The storage pool could be of type Cloud, Primary, Snapshot, or OnVault. See the Backup and DR documentation on storage pools. For example, DiskPoolOne.
policyOptions[]

string

The names of Backup and DR advanced policy options of a policy applying to an application. See the Backup and DR documentation on policy options. For example, skipofflineappsincongrp, nounmap.
profile

string

The name of the Backup and DR resource profile that specifies the storage media for backups of application and VM data. See the Backup and DR documentation on profiles. For example, GCP.
appliance

string

The name of the Backup and DR appliance that captures, moves, and manages the lifecycle of backup data. For example, backup-server-57137.
backupType

string

The backup type of the Backup and DR image. For example, Snapshot, Remote Snapshot, OnVault.
backupCreateTime

string (Timestamp format)

The timestamp at which the Backup and DR backup was created.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

SecurityPosture

Represents a posture that is deployed on Google Cloud by the Security Command Center Posture Management service. A posture contains one or more policy sets. A policy set is a group of policies that enforce a set of security rules on Google Cloud.

JSON representation 
{
  "name": string,
  "revisionId": string,
  "postureDeploymentResource": string,
  "postureDeployment": string,
  "changedPolicy": string,
  "policySet": string,
  "policy": string,
  "policyDriftDetails": [
    {
      object (PolicyDriftDetails)
    }
  ]
}
Fields
name

string

Name of the posture, for example, CIS-Posture.
revisionId

string

The version of the posture, for example, c7cfa2a8.
postureDeploymentResource

string

The project, folder, or organization on which the posture is deployed, for example, projects/{project_number}.
postureDeployment

string

The name of the posture deployment, for example, organizations/{org_id}/posturedeployments/{posture_deployment_id}.
changedPolicy

string

The name of the updated policy, for example, projects/{projectId}/policies/{constraint_name}.
policySet

string

The name of the updated policyset, for example, cis-policyset.
policy

string

The ID of the updated policy, for example, compute-policy-1.
policyDriftDetails[]

object (PolicyDriftDetails)

The details about a change in an updated policy that violates the deployed posture.

PolicyDriftDetails

The policy field that violates the deployed posture and its expected and detected values.

JSON representation 
{
  "field": string,
  "expectedValue": string,
  "detectedValue": string
}
Fields
field

string

The name of the updated field, for example constraint.implementation.policy_rules[0].enforce
expectedValue

string

The value of this field that was configured in a posture, for example, true or allowed_values={"projects/29831892"}.
detectedValue

string

The detected value that violates the deployed posture, for example, false or allowed_values={"projects/22831892"}.

LogEntry

An individual entry in a log.

JSON representation 
{

  // Union field log_entry can be only one of the following:
  "cloudLoggingEntry": {
    object (CloudLoggingEntry)
  }
  // End of list of possible types for union field log_entry.
}
Fields

Union field log_entry.

log_entry can be only one of the following:
cloudLoggingEntry

object (CloudLoggingEntry)

An individual entry in a log stored in Cloud Logging.

CloudLoggingEntry

Metadata taken from a Cloud Logging LogEntry

JSON representation 
{
  "insertId": string,
  "logId": string,
  "resourceContainer": string,
  "timestamp": string
}
Fields
insertId

string

A unique identifier for the log entry.
logId

string

The type of the log (part of logName. logName is the resource name of the log to which this log entry belongs). For example: cloudresourcemanager.googleapis.com/activity. Note that this field is not URL-encoded, unlike the LOG_ID field in LogEntry.
resourceContainer

string

The organization, folder, or project of the monitored resource that produced this log entry.
timestamp

string (Timestamp format)

The time the event described by the log entry occurred.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

LoadBalancer

Contains information related to the load balancer associated with the finding.

JSON representation 
{
  "name": string
}
Fields
name

string

The name of the load balancer associated with the finding.

CloudArmor

Fields related to Google Cloud Armor findings.

JSON representation 
{
  "securityPolicy": {
    object (SecurityPolicy)
  },
  "requests": {
    object (Requests)
  },
  "adaptiveProtection": {
    object (AdaptiveProtection)
  },
  "attack": {
    object (Attack)
  },
  "threatVector": string,
  "duration": string
}
Fields
securityPolicy

object (SecurityPolicy)

Information about the Google Cloud Armor security policy relevant to the finding.
requests

object (Requests)

Information about incoming requests evaluated by Google Cloud Armor security policies.
adaptiveProtection

object (AdaptiveProtection)

Information about potential Layer 7 DDoS attacks identified by Google Cloud Armor Adaptive Protection.
attack

object (Attack)

Information about DDoS attack volume and classification.
threatVector

string

Distinguish between volumetric & protocol DDoS attack and application layer attacks. For example, "L3_4" for Layer 3 and Layer 4 DDoS attacks, or "L_7" for Layer 7 DDoS attacks.
duration

string (Duration format)

Duration of attack from the start until the current moment (updated every 5 minutes).

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".

SecurityPolicy

Information about the Google Cloud Armor security policy relevant to the finding.

JSON representation 
{
  "name": string,
  "type": string,
  "preview": boolean
}
Fields
name

string

The name of the Google Cloud Armor security policy, for example, "my-security-policy".
type

string

The type of Google Cloud Armor security policy for example, 'backend security policy', 'edge security policy', 'network edge security policy', or 'always-on DDoS protection'.
preview

boolean

Whether or not the associated rule or policy is in preview mode.

Requests

Information about the requests relevant to the finding.

JSON representation 
{
  "ratio": number,
  "shortTermAllowed": integer,
  "longTermAllowed": integer,
  "longTermDenied": integer
}
Fields
ratio

number

For 'Increasing deny ratio', the ratio is the denied traffic divided by the allowed traffic. For 'Allowed traffic spike', the ratio is the allowed traffic in the short term divided by allowed traffic in the long term.
shortTermAllowed

integer

Allowed RPS (requests per second) in the short term.
longTermAllowed

integer

Allowed RPS (requests per second) over the long term.
longTermDenied

integer

Denied RPS (requests per second) over the long term.

AdaptiveProtection

Information about Google Cloud Armor Adaptive Protection.

JSON representation 
{
  "confidence": number
}
Fields
confidence

number

A score of 0 means that there is low confidence that the detected event is an actual attack. A score of 1 means that there is high confidence that the detected event is an attack. See the Adaptive Protection documentation for further explanation.

Attack

Information about DDoS attack volume and classification.

JSON representation 
{
  "volumePps": integer,
  "volumeBps": integer,
  "classification": string
}
Fields
volumePps

integer

Total PPS (packets per second) volume of attack.
volumeBps

integer

Total BPS (bytes per second) volume of attack.
classification

string

Type of attack, for example, 'SYN-flood', 'NTP-udp', or 'CHARGEN-udp'.

Notebook

Represents a Jupyter notebook IPYNB file, such as a Colab Enterprise notebook file, that is associated with a finding.

JSON representation 
{
  "name": string,
  "service": string,
  "lastAuthor": string,
  "notebookUpdateTime": string
}
Fields
name

string

The name of the notebook.
service

string

The source notebook service, for example, "Colab Enterprise".
lastAuthor

string

The user ID of the latest author to modify the notebook.
notebookUpdateTime

string (Timestamp format)

The most recent time the notebook was updated.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

ToxicCombination

Contains details about a group of security issues that, when the issues occur together, represent a greater risk than when the issues occur independently. A group of such issues is referred to as a toxic combination.

JSON representation 
{
  "attackExposureScore": number,
  "relatedFindings": [
    string
  ]
}
Fields
attackExposureScore

number

The Attack exposure score of this toxic combination. The score is a measure of how much this toxic combination exposes one or more high-value resources to potential attack.
relatedFindings[]

string

List of resource names of findings associated with this toxic combination. For example, organizations/123/sources/456/findings/789.

GroupMembership

Contains details about groups of which this finding is a member. A group is a collection of findings that are related in some way.

JSON representation 
{
  "groupType": enum (GroupType),
  "groupId": string
}
Fields
groupType

enum (GroupType)

Type of group.
groupId

string

ID of the group.

GroupType

Possible types of groups.

Enums
GROUP_TYPE_UNSPECIFIED Default value.
GROUP_TYPE_TOXIC_COMBINATION Group represents a toxic combination.

DataAccessEvent

Details about a data access attempt made by a principal not authorized under applicable data security policy.

JSON representation 
{
  "eventId": string,
  "principalEmail": string,
  "operation": enum (Operation),
  "eventTime": string
}
Fields
eventId

string

Unique identifier for data access event.
principalEmail

string

The email address of the principal that accessed the data. The principal could be a user account, service account, Google group, or other.
operation

enum (Operation)

The operation performed by the principal to access the data.
eventTime

string (Timestamp format)

Timestamp of data access event.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Operation

The operation of a data access event.

Enums
OPERATION_UNSPECIFIED The operation is unspecified.
READ Represents a read operation.
MOVE Represents a move operation.
COPY Represents a copy operation.

DataFlowEvent

Details about a data flow event, in which either the data is moved to or is accessed from a non-compliant geo-location, as defined in the applicable data security policy.

JSON representation 
{
  "eventId": string,
  "principalEmail": string,
  "operation": enum (Operation),
  "violatedLocation": string,
  "eventTime": string
}
Fields
eventId

string

Unique identifier for data flow event.
principalEmail

string

The email address of the principal that initiated the data flow event. The principal could be a user account, service account, Google group, or other.
operation

enum (Operation)

The operation performed by the principal for the data flow event.
violatedLocation

string

Non-compliant location of the principal or the data destination.
eventTime

string (Timestamp format)

Timestamp of data flow event.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Operation

The operation of a data flow event.

Enums
OPERATION_UNSPECIFIED The operation is unspecified.
READ Represents a read operation.
MOVE Represents a move operation.
COPY Represents a copy operation.

Methods

create

 Creates a finding.

group

 Filters an organization or source's findings and groups them by their specified properties.

list

 Lists an organization or source's findings.

patch

 Creates or updates a finding.

setMute

 Updates the mute state of a finding.

setState

 Updates the state of a finding.

updateSecurityMarks

 Updates security marks.