SimulateSecurityHealthAnalyticsCustomModuleResponse

Response message for SecurityCenterManagement.SimulateSecurityHealthAnalyticsCustomModule.

JSON representation 
{
  "result": {
    object (SimulatedResult)
  }
}
Fields
result

object (SimulatedResult)

Result for test case in the corresponding request.

SimulatedResult

Possible test result.

JSON representation 
{

  // Union field result can be only one of the following:
  "finding": {
    object (SimulatedFinding)
  },
  "noViolation": {
    object
  },
  "error": {
    object (Status)
  }
  // End of list of possible types for union field result.
}
Fields
Union field result. The result of the simulation. result can be only one of the following:
finding

object (SimulatedFinding)

Finding that would be published for the test case if a violation is detected.
noViolation

object

Indicates that the test case does not trigger any violation.
error

object (Status)

Error encountered during the test.

SimulatedFinding

The minimum set of fields needed to represent a simulated finding from a Security Health Analytics custom module.

JSON representation 
{
  "name": string,
  "parent": string,
  "resourceName": string,
  "category": string,
  "state": enum (State),
  "sourceProperties": {
    string: value,
    ...
  },
  "eventTime": string,
  "severity": enum (Severity),
  "findingClass": enum (FindingClass)
}
Fields
name

string

Identifier. The relative resource name of the finding, in one of the following formats:

  • organizations/{organization_id}/sources/{source_id}/findings/{finding_id}
  • folders/{folder_id}/sources/{source_id}/findings/{finding_id}
  • projects/{projectId}/sources/{source_id}/findings/{finding_id}
parent

string

The relative resource name of the source the finding belongs to. For example, organizations/{organization_id}/sources/{source_id}. This field is immutable after creation time.
resourceName

string

For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. When the finding is for a non-Google Cloud resource, the value can be a customer or partner defined string. This field is immutable after creation time.
category

string

The additional taxonomy group within findings from a given source. For example, XSS_FLASH_INJECTION. This field is immutable after creation time.
state

enum (State)

Output only. The state of the finding.
sourceProperties

map (key: string, value: value (Value format))

Source-specific properties. These properties are managed by the source that writes the finding. The key names must be between 1 and 255 characters; they must start with a letter and contain alphanumeric characters or underscores only.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
eventTime

string (Timestamp format)

The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. If the finding is later resolved, then this time reflects when the finding was resolved.

For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector.

The event time must not be set to a value greater than the current timestamp.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
severity

enum (Severity)

The severity of the finding. This field is managed by the source that writes the finding.
findingClass

enum (FindingClass)

The class of the finding.

State

The state of the finding.

Enums
STATE_UNSPECIFIED Default value. This value is unused.
ACTIVE The finding requires attention and has not been addressed yet.
INACTIVE The finding has been fixed, triaged as a non-issue, or otherwise addressed and is no longer active.

Severity

The severity of the finding.

Enums
SEVERITY_UNSPECIFIED Default value. This value is unused.
CRITICAL

For vulnerabilities: A critical vulnerability is easily discoverable by an external actor, exploitable, and results in the direct ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. Examples include publicly accessible unprotected user data and public SSH access with weak or no passwords.

For threats: Indicates a threat that is able to access, modify, or delete data or execute unauthorized code within existing resources.
HIGH

For vulnerabilities: A high-risk vulnerability can be easily discovered and exploited in combination with other vulnerabilities in order to gain direct access and the ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. An example is a database with weak or no passwords that is only accessible internally. This database could easily be compromised by an actor that had access to the internal network.

For threats: Indicates a threat that is able to create new computational resources in an environment but not able to access data or execute code in existing resources.
MEDIUM

For vulnerabilities: A medium-risk vulnerability could be used by an actor to gain access to resources or privileges that enable them to eventually (through multiple steps or a complex exploit) gain access and the ability to execute arbitrary code or exfiltrate data. An example is a service account with access to more projects than it should have. If an actor gains access to the service account, they could potentially use that access to manipulate a project the service account was not intended to.

For threats: Indicates a threat that is able to cause operational impact but may not access data or execute unauthorized code.
LOW

For vulnerabilities: A low-risk vulnerability hampers a security organization's ability to detect vulnerabilities or active threats in their deployment, or prevents the root cause investigation of security issues. An example is monitoring and logs being disabled for resource configurations and access.

For threats: Indicates a threat that has obtained minimal access to an environment but is not able to access data, execute code, or create resources.

FindingClass

Represents what kind of finding it is.

Enums
FINDING_CLASS_UNSPECIFIED Default value. This value is unused.
THREAT Describes unwanted or malicious activity.
VULNERABILITY Describes a potential weakness in software that increases risk to confidentiality, integrity, and availability.
MISCONFIGURATION Describes a potential weakness in cloud resource or asset configuration that increases risk.
OBSERVATION Describes a security observation that is for informational purposes.
SCC_ERROR Describes an error that prevents Security Command Center from working correctly.
POSTURE_VIOLATION Describes a potential security risk due to a change in the security posture.
TOXIC_COMBINATION Describes a combination of security issues that represent a more severe security problem when taken together.

Status

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details.

You can find out more about this error model and how to work with it in the API Design Guide.

JSON representation 
{
  "code": integer,
  "message": string,
  "details": [
    {
      "@type": string,
      field1: ...,
      ...
    }
  ]
}
Fields
code

integer

The status code, which should be an enum value of google.rpc.Code.
message

string

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
details[]

object

A list of messages that carry the error details. There is a common set of message types for APIs to use.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.