REST Resource: organizations.sources.findings

• Resource: Finding
  • JSON representation
• State
• SecurityMarks
  • JSON representation
• Methods

Resource: Finding

Cloud Security Command Center (Cloud SCC) finding.

A finding is a record of assessment data (security, risk, health or privacy) ingested into Cloud SCC for presentation, notification, analysis, policy testing, and enforcement. For example, an XSS vulnerability in an App Engine application is a finding.

JSON representation
{ "name": string, "parent": string, "resourceName": string, "state": enum (State), "category": string, "externalUri": string, "sourceProperties": { string: value, ... }, "securityMarks": { object (SecurityMarks) }, "eventTime": string, "createTime": string }

Fields
name	string The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/123/sources/456/findings/789"
parent	string The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/123/sources/456"
resourceName	string The full resource name of the Google Cloud Platform (GCP) resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name This field is immutable after creation time.
state	enum (State) The state of the finding.
category	string The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"
externalUri	string The URI that, if available, points to a web page outside of Cloud SCC where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.
sourceProperties	map (key: string, value: value (Value format)) Source specific properties. These properties are managed by the source that writes the finding. The key names in the sourceProperties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
securityMarks	object (SecurityMarks) Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
eventTime	string (Timestamp format) The time at which the event took place. For example, if the finding represents an open firewall it would capture the time the open firewall was detected. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
createTime	string (Timestamp format) The time at which the finding was created in Cloud SCC. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

State

The state of the finding.

Enums
STATE_UNSPECIFIED	Unspecified state.
ACTIVE	The finding requires attention and has not been addressed yet.
INACTIVE	The finding has been fixed, triaged as a non-issue or otherwise addressed and is no longer active.

SecurityMarks

User specified security marks that are attached to the parent Cloud Security Command Center (Cloud SCC) resource. Security marks are scoped within a Cloud SCC organization -- they can be modified and viewed by all users who have proper permissions on the organization.

JSON representation
{ "name": string, "marks": { string: string, ... } }

Fields
name	string The relative resource name of the SecurityMarks. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Examples: "organizations/123/assets/456/securityMarks" "organizations/123/sources/456/findings/789/securityMarks".
marks	map (key: string, value: string) Mutable user specified security marks belonging to the parent resource. Constraints are as follows: - Keys and values are treated as case insensitive - Keys must be between 1 - 256 characters (inclusive) - Keys must be letters, numbers, underscores, or dashes - Values have leading and trailing whitespace trimmed, remaining characters must be between 1 - 4096 characters (inclusive) An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

Methods
create	Creates a finding.
group	Filters an organization or source's findings and groups them by their specified properties.
list	Lists an organization or source's findings.
patch	Creates or updates a finding.
setState	Updates the state of a finding.
updateSecurityMarks	Updates security marks.