Class Finding (2.61.0)

Security Command Center finding.

A finding is a record of assessment data like security, risk, health, or privacy, that is ingested into Security Command Center for presentation, notification, analysis, policy testing, and enforcement. For example, a cross-site scripting (XSS) vulnerability in an App Engine application is a finding.

Protobuf type google.cloud.securitycenter.v2.Finding

Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories

 {
   "security": {
     "contacts": [
       {
         "email": "person1@company.com"
       },
       {
         "email": "person2@company.com"
       }
     ]
   }
 }

map<string, .google.cloud.securitycenter.v2.ContactDetails> contacts = 26 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

map<string, .google.cloud.securitycenter.v2.ExternalSystem> external_systems = 20 [(.google.api.field_behavior) = OUTPUT_ONLY];

Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.

map<string, .google.protobuf.Value> source_properties = 9;

Access details associated with the finding, such as more information on the caller, which method was accessed, and from where.

.google.cloud.securitycenter.v2.Access access = 22;

Access details associated with the finding, such as more information on the caller, which method was accessed, and from where.

.google.cloud.securitycenter.v2.Access access = 22;

Represents an application associated with the finding.

.google.cloud.securitycenter.v2.Application application = 45;

Represents an application associated with the finding.

.google.cloud.securitycenter.v2.Application application = 45;

The results of an attack path simulation relevant to this finding.

.google.cloud.securitycenter.v2.AttackExposure attack_exposure = 38;

The results of an attack path simulation relevant to this finding.

.google.cloud.securitycenter.v2.AttackExposure attack_exposure = 38;

Fields related to Backup and DR findings.

.google.cloud.securitycenter.v2.BackupDisasterRecovery backup_disaster_recovery = 47;

Fields related to Backup and DR findings.

.google.cloud.securitycenter.v2.BackupDisasterRecovery backup_disaster_recovery = 47;

Output only. The canonical name of the finding. The following list shows some examples:

+ organizations/{organization_id}/sources/{source_id}/findings/{finding_id} + organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}

• folders/{folder_id}/sources/{source_id}/findings/{finding_id} + folders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}

• projects/{project_id}/sources/{source_id}/findings/{finding_id} + projects/{project_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}

  The prefix is the closest CRM ancestor of the resource associated with the finding.

string canonical_name = 2 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. The canonical name of the finding. The following list shows some examples:

+ organizations/{organization_id}/sources/{source_id}/findings/{finding_id} + organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}

• folders/{folder_id}/sources/{source_id}/findings/{finding_id} + folders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}

• projects/{project_id}/sources/{source_id}/findings/{finding_id} + projects/{project_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}

  The prefix is the closest CRM ancestor of the resource associated with the finding.

string canonical_name = 2 [(.google.api.field_behavior) = OUTPUT_ONLY];

Immutable. The additional taxonomy group within findings from a given source. Example: "XSS_FLASH_INJECTION"

string category = 7 [(.google.api.field_behavior) = IMMUTABLE];

Immutable. The additional taxonomy group within findings from a given source. Example: "XSS_FLASH_INJECTION"

string category = 7 [(.google.api.field_behavior) = IMMUTABLE];

Fields related to Cloud Armor findings.

.google.cloud.securitycenter.v2.CloudArmor cloud_armor = 51;

Fields related to Cloud Armor findings.

.google.cloud.securitycenter.v2.CloudArmor cloud_armor = 51;

Cloud DLP data profile that is associated with the finding.

.google.cloud.securitycenter.v2.CloudDlpDataProfile cloud_dlp_data_profile = 41;

Cloud DLP data profile that is associated with the finding.

.google.cloud.securitycenter.v2.CloudDlpDataProfile cloud_dlp_data_profile = 41;

Cloud Data Loss Prevention (Cloud DLP) inspection results that are associated with the finding.

.google.cloud.securitycenter.v2.CloudDlpInspection cloud_dlp_inspection = 40;

Cloud Data Loss Prevention (Cloud DLP) inspection results that are associated with the finding.

.google.cloud.securitycenter.v2.CloudDlpInspection cloud_dlp_inspection = 40;

Contains compliance information for security standards associated to the finding.

repeated .google.cloud.securitycenter.v2.Compliance compliances = 27;

Contains compliance information for security standards associated to the finding.

repeated .google.cloud.securitycenter.v2.Compliance compliances = 27;

Contains compliance information for security standards associated to the finding.

repeated .google.cloud.securitycenter.v2.Compliance compliances = 27;

Contains compliance information for security standards associated to the finding.

repeated .google.cloud.securitycenter.v2.Compliance compliances = 27;

Contains compliance information for security standards associated to the finding.

repeated .google.cloud.securitycenter.v2.Compliance compliances = 27;

Contains information about the IP connection associated with the finding.

repeated .google.cloud.securitycenter.v2.Connection connections = 23;

Contains information about the IP connection associated with the finding.

repeated .google.cloud.securitycenter.v2.Connection connections = 23;

Contains information about the IP connection associated with the finding.

repeated .google.cloud.securitycenter.v2.Connection connections = 23;

Contains information about the IP connection associated with the finding.

repeated .google.cloud.securitycenter.v2.Connection connections = 23;

Contains information about the IP connection associated with the finding.

repeated .google.cloud.securitycenter.v2.Connection connections = 23;

Use #getContactsMap() instead.

Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories

 {
   "security": {
     "contacts": [
       {
         "email": "person1@company.com"
       },
       {
         "email": "person2@company.com"
       }
     ]
   }
 }

map<string, .google.cloud.securitycenter.v2.ContactDetails> contacts = 26 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories

 {
   "security": {
     "contacts": [
       {
         "email": "person1@company.com"
       },
       {
         "email": "person2@company.com"
       }
     ]
   }
 }

map<string, .google.cloud.securitycenter.v2.ContactDetails> contacts = 26 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories

 {
   "security": {
     "contacts": [
       {
         "email": "person1@company.com"
       },
       {
         "email": "person2@company.com"
       }
     ]
   }
 }

map<string, .google.cloud.securitycenter.v2.ContactDetails> contacts = 26 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories

 {
   "security": {
     "contacts": [
       {
         "email": "person1@company.com"
       },
       {
         "email": "person2@company.com"
       }
     ]
   }
 }

map<string, .google.cloud.securitycenter.v2.ContactDetails> contacts = 26 [(.google.api.field_behavior) = OUTPUT_ONLY];

Containers associated with the finding. This field provides information for both Kubernetes and non-Kubernetes containers.

repeated .google.cloud.securitycenter.v2.Container containers = 35;

Containers associated with the finding. This field provides information for both Kubernetes and non-Kubernetes containers.

repeated .google.cloud.securitycenter.v2.Container containers = 35;

Containers associated with the finding. This field provides information for both Kubernetes and non-Kubernetes containers.

repeated .google.cloud.securitycenter.v2.Container containers = 35;

Containers associated with the finding. This field provides information for both Kubernetes and non-Kubernetes containers.

repeated .google.cloud.securitycenter.v2.Container containers = 35;

Containers associated with the finding. This field provides information for both Kubernetes and non-Kubernetes containers.

repeated .google.cloud.securitycenter.v2.Container containers = 35;

Output only. The time at which the finding was created in Security Command Center.

.google.protobuf.Timestamp create_time = 12 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. The time at which the finding was created in Security Command Center.

.google.protobuf.Timestamp create_time = 12 [(.google.api.field_behavior) = OUTPUT_ONLY];

Database associated with the finding.

.google.cloud.securitycenter.v2.Database database = 37;

Database associated with the finding.

.google.cloud.securitycenter.v2.Database database = 37;

Contains more details about the finding.

string description = 30;

Contains more details about the finding.

string description = 30;

The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.

.google.protobuf.Timestamp event_time = 11;

The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.

.google.protobuf.Timestamp event_time = 11;

Represents exfiltrations associated with the finding.

.google.cloud.securitycenter.v2.Exfiltration exfiltration = 31;

Represents exfiltrations associated with the finding.

.google.cloud.securitycenter.v2.Exfiltration exfiltration = 31;

Use #getExternalSystemsMap() instead.

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

map<string, .google.cloud.securitycenter.v2.ExternalSystem> external_systems = 20 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

map<string, .google.cloud.securitycenter.v2.ExternalSystem> external_systems = 20 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

map<string, .google.cloud.securitycenter.v2.ExternalSystem> external_systems = 20 [(.google.api.field_behavior) = OUTPUT_ONLY];

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

map<string, .google.cloud.securitycenter.v2.ExternalSystem> external_systems = 20 [(.google.api.field_behavior) = OUTPUT_ONLY];

The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.

string external_uri = 8;

The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.

string external_uri = 8;

File associated with the finding.

repeated .google.cloud.securitycenter.v2.File files = 39;

File associated with the finding.

repeated .google.cloud.securitycenter.v2.File files = 39;