--- /dev/null
+// Copyright 2019 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v1;
+
+import "google/api/annotations.proto";
+import "google/cloud/securitycenter/v1/asset.proto";
+import "google/cloud/securitycenter/v1/finding.proto";
+import "google/cloud/securitycenter/v1/organization_settings.proto";
+import "google/cloud/securitycenter/v1/security_marks.proto";
+import "google/cloud/securitycenter/v1/source.proto";
+import "google/iam/v1/iam_policy.proto";
+import "google/iam/v1/policy.proto";
+import "google/longrunning/operations.proto";
+import "google/protobuf/duration.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+import "google/protobuf/struct.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
+option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
+option java_multiple_files = true;
+option java_package = "com.google.cloud.securitycenter.v1";
+
+// V1 APIs for Security Center service.
+service SecurityCenter {
+ // Creates a source.
+ rpc CreateSource(CreateSourceRequest) returns (Source) {
+ option (google.api.http) = {
+ post: "/v1/{parent=organizations/*}/sources"
+ body: "source"
+ };
+ }
+
+ // Creates a finding. The corresponding source must exist for finding creation
+ // to succeed.
+ rpc CreateFinding(CreateFindingRequest) returns (Finding) {
+ option (google.api.http) = {
+ post: "/v1/{parent=organizations/*/sources/*}/findings"
+ body: "finding"
+ };
+ }
+
+ // Gets the access control policy on the specified Source.
+ rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest)
+ returns (google.iam.v1.Policy) {
+ option (google.api.http) = {
+ post: "/v1/{resource=organizations/*/sources/*}:getIamPolicy"
+ body: "*"
+ };
+ }
+
+ // Gets the settings for an organization.
+ rpc GetOrganizationSettings(GetOrganizationSettingsRequest)
+ returns (OrganizationSettings) {
+ option (google.api.http) = {
+ get: "/v1/{name=organizations/*/organizationSettings}"
+ };
+ }
+
+ // Gets a source.
+ rpc GetSource(GetSourceRequest) returns (Source) {
+ option (google.api.http) = {
+ get: "/v1/{name=organizations/*/sources/*}"
+ };
+ }
+
+ // Filters an organization's assets and groups them by their specified
+ // properties.
+ rpc GroupAssets(GroupAssetsRequest) returns (GroupAssetsResponse) {
+ option (google.api.http) = {
+ post: "/v1/{parent=organizations/*}/assets:group"
+ body: "*"
+ };
+ }
+
+ // Filters an organization or source's findings and groups them by their
+ // specified properties.
+ //
+ // To group across all sources provide a `-` as the source id.
+ // Example: /v1/organizations/123/sources/-/findings
+ rpc GroupFindings(GroupFindingsRequest) returns (GroupFindingsResponse) {
+ option (google.api.http) = {
+ post: "/v1/{parent=organizations/*/sources/*}/findings:group"
+ body: "*"
+ };
+ }
+
+ // Lists an organization's assets.
+ rpc ListAssets(ListAssetsRequest) returns (ListAssetsResponse) {
+ option (google.api.http) = {
+ get: "/v1/{parent=organizations/*}/assets"
+ };
+ }
+
+ // Lists an organization or source's findings.
+ //
+ // To list across all sources provide a `-` as the source id.
+ // Example: /v1/organizations/123/sources/-/findings
+ rpc ListFindings(ListFindingsRequest) returns (ListFindingsResponse) {
+ option (google.api.http) = {
+ get: "/v1/{parent=organizations/*/sources/*}/findings"
+ };
+ }
+
+ // Lists all sources belonging to an organization.
+ rpc ListSources(ListSourcesRequest) returns (ListSourcesResponse) {
+ option (google.api.http) = {
+ get: "/v1/{parent=organizations/*}/sources"
+ };
+ }
+
+ // Runs asset discovery. The discovery is tracked with a long-running
+ // operation.
+ //
+ // This API can only be called with limited frequency for an organization. If
+ // it is called too frequently the caller will receive a TOO_MANY_REQUESTS
+ // error.
+ rpc RunAssetDiscovery(RunAssetDiscoveryRequest)
+ returns (google.longrunning.Operation) {
+ option (google.api.http) = {
+ post: "/v1/{parent=organizations/*}/assets:runDiscovery"
+ body: "*"
+ };
+ }
+
+ // Updates the state of a finding.
+ rpc SetFindingState(SetFindingStateRequest) returns (Finding) {
+ option (google.api.http) = {
+ post: "/v1/{name=organizations/*/sources/*/findings/*}:setState"
+ body: "*"
+ };
+ }
+
+ // Sets the access control policy on the specified Source.
+ rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest)
+ returns (google.iam.v1.Policy) {
+ option (google.api.http) = {
+ post: "/v1/{resource=organizations/*/sources/*}:setIamPolicy"
+ body: "*"
+ };
+ }
+
+ // Returns the permissions that a caller has on the specified source.
+ rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest)
+ returns (google.iam.v1.TestIamPermissionsResponse) {
+ option (google.api.http) = {
+ post: "/v1/{resource=organizations/*/sources/*}:testIamPermissions"
+ body: "*"
+ };
+ }
+
+ // Creates or updates a finding. The corresponding source must exist for a
+ // finding creation to succeed.
+ rpc UpdateFinding(UpdateFindingRequest) returns (Finding) {
+ option (google.api.http) = {
+ patch: "/v1/{finding.name=organizations/*/sources/*/findings/*}"
+ body: "finding"
+ };
+ }
+
+ // Updates an organization's settings.
+ rpc UpdateOrganizationSettings(UpdateOrganizationSettingsRequest)
+ returns (OrganizationSettings) {
+ option (google.api.http) = {
+ patch: "/v1/{organization_settings.name=organizations/*/organizationSettings}"
+ body: "organization_settings"
+ };
+ }
+
+ // Updates a source.
+ rpc UpdateSource(UpdateSourceRequest) returns (Source) {
+ option (google.api.http) = {
+ patch: "/v1/{source.name=organizations/*/sources/*}"
+ body: "source"
+ };
+ }
+
+ // Updates security marks.
+ rpc UpdateSecurityMarks(UpdateSecurityMarksRequest) returns (SecurityMarks) {
+ option (google.api.http) = {
+ patch: "/v1/{security_marks.name=organizations/*/assets/*/securityMarks}"
+ body: "security_marks"
+ additional_bindings {
+ patch: "/v1/{security_marks.name=organizations/*/sources/*/findings/*/securityMarks}"
+ body: "security_marks"
+ }
+ };
+ }
+}
+
+// Request message for creating a finding.
+message CreateFindingRequest {
+ // Resource name of the new finding's parent. Its format should be
+ // "organizations/[organization_id]/sources/[source_id]".
+ string parent = 1;
+
+ // Unique identifier provided by the client within the parent scope.
+ // It must be alphanumeric and less than or equal to 32 characters and
+ // greater than 0 characters in length.
+ string finding_id = 2;
+
+ // The Finding being created. The name and security_marks will be ignored as
+ // they are both output only fields on this resource.
+ Finding finding = 3;
+}
+
+// Request message for creating a source.
+message CreateSourceRequest {
+ // Resource name of the new source's parent. Its format should be
+ // "organizations/[organization_id]".
+ string parent = 1;
+
+ // The Source being created, only the display_name and description will be
+ // used. All other fields will be ignored.
+ Source source = 2;
+}
+
+// Request message for getting organization settings.
+message GetOrganizationSettingsRequest {
+ // Name of the organization to get organization settings for. Its format is
+ // "organizations/[organization_id]/organizationSettings".
+ string name = 1;
+}
+
+// Request message for getting a source.
+message GetSourceRequest {
+ // Relative resource name of the source. Its format is
+ // "organizations/[organization_id]/source/[source_id]".
+ string name = 1;
+}
+
+// Request message for grouping by assets.
+message GroupAssetsRequest {
+ // Name of the organization to groupBy. Its format is
+ // "organizations/[organization_id]".
+ string parent = 1;
+
+ // Expression that defines the filter to apply across assets.
+ // The expression is a list of zero or more restrictions combined via logical
+ // operators `AND` and `OR`.
+ // Parentheses are supported, and `OR` has higher precedence than `AND`.
+ //
+ // Restrictions have the form `<field> <operator> <value>` and may have a `-`
+ // character in front of them to indicate negation. The fields map to those
+ // defined in the Asset resource. Examples include:
+ //
+ // * name
+ // * security_center_properties.resource_name
+ // * resource_properties.a_property
+ // * security_marks.marks.marka
+ //
+ // The supported operators are:
+ //
+ // * `=` for all value types.
+ // * `>`, `<`, `>=`, `<=` for integer values.
+ // * `:`, meaning substring matching, for strings.
+ //
+ // The supported value types are:
+ //
+ // * string literals in quotes.
+ // * integer literals without quotes.
+ // * boolean literals `true` and `false` without quotes.
+ //
+ // For example, `resource_properties.size = 100` is a valid filter string.
+ string filter = 2;
+
+ // Expression that defines what assets fields to use for grouping. The string
+ // value should follow SQL syntax: comma separated list of fields. For
+ // example:
+ // "security_center_properties.resource_project,security_center_properties.project".
+ //
+ // The following fields are supported when compare_duration is not set:
+ //
+ // * security_center_properties.resource_project
+ // * security_center_properties.resource_type
+ // * security_center_properties.resource_parent
+ //
+ // The following fields are supported when compare_duration is set:
+ //
+ // * security_center_properties.resource_type
+ string group_by = 3;
+
+ // When compare_duration is set, the GroupResult's "state_change" property is
+ // updated to indicate whether the asset was added, removed, or remained
+ // present during the compare_duration period of time that precedes the
+ // read_time. This is the time between (read_time - compare_duration) and
+ // read_time.
+ //
+ // The state change value is derived based on the presence of the asset at the
+ // two points in time. Intermediate state changes between the two times don't
+ // affect the result. For example, the results aren't affected if the asset is
+ // removed and re-created again.
+ //
+ // Possible "state_change" values when compare_duration is specified:
+ //
+ // * "ADDED": indicates that the asset was not present at the start of
+ // compare_duration, but present at reference_time.
+ // * "REMOVED": indicates that the asset was present at the start of
+ // compare_duration, but not present at reference_time.
+ // * "ACTIVE": indicates that the asset was present at both the
+ // start and the end of the time period defined by
+ // compare_duration and reference_time.
+ //
+ // If compare_duration is not specified, then the only possible state_change
+ // is "UNUSED", which will be the state_change set for all assets present at
+ // read_time.
+ //
+ // If this field is set then `state_change` must be a specified field in
+ // `group_by`.
+ google.protobuf.Duration compare_duration = 4;
+
+ // Time used as a reference point when filtering assets. The filter is limited
+ // to assets existing at the supplied time and their values are those at that
+ // specific time. Absence of this field will default to the API's version of
+ // NOW.
+ google.protobuf.Timestamp read_time = 5;
+
+ // The value returned by the last `GroupAssetsResponse`; indicates
+ // that this is a continuation of a prior `GroupAssets` call, and that the
+ // system should return the next page of data.
+ string page_token = 7;
+
+ // The maximum number of results to return in a single response. Default is
+ // 10, minimum is 1, maximum is 1000.
+ int32 page_size = 8;
+
+ reserved 6;
+}
+
+// Response message for grouping by assets.
+message GroupAssetsResponse {
+ // Group results. There exists an element for each existing unique
+ // combination of property/values. The element contains a count for the number
+ // of times those specific property/values appear.
+ repeated GroupResult group_by_results = 1;
+
+ // Time used for executing the groupBy request.
+ google.protobuf.Timestamp read_time = 2;
+
+ // Token to retrieve the next page of results, or empty if there are no more
+ // results.
+ string next_page_token = 3;
+
+ // The total number of results matching the query.
+ int32 total_size = 4;
+}
+
+// Request message for grouping by findings.
+message GroupFindingsRequest {
+ // Name of the source to groupBy. Its format is
+ // "organizations/[organization_id]/sources/[source_id]". To groupBy across
+ // all sources provide a source_id of `-`. For example:
+ // organizations/123/sources/-
+ string parent = 1;
+
+ // Expression that defines the filter to apply across findings.
+ // The expression is a list of one or more restrictions combined via logical
+ // operators `AND` and `OR`.
+ // Parentheses are supported, and `OR` has higher precedence than `AND`.
+ //
+ // Restrictions have the form `<field> <operator> <value>` and may have a `-`
+ // character in front of them to indicate negation. Examples include:
+ //
+ // * name
+ // * source_properties.a_property
+ // * security_marks.marks.marka
+ //
+ // The supported operators are:
+ //
+ // * `=` for all value types.
+ // * `>`, `<`, `>=`, `<=` for integer values.
+ // * `:`, meaning substring matching, for strings.
+ //
+ // The supported value types are:
+ //
+ // * string literals in quotes.
+ // * integer literals without quotes.
+ // * boolean literals `true` and `false` without quotes.
+ //
+ // For example, `source_properties.size = 100` is a valid filter string.
+ string filter = 2;
+
+ // Expression that defines what assets fields to use for grouping (including
+ // `state_change`). The string value should follow SQL syntax: comma separated
+ // list of fields. For example: "parent,resource_name".
+ //
+ // The following fields are supported:
+ //
+ // * resource_name
+ // * category
+ // * state
+ // * state_change
+ // * parent
+ string group_by = 3;
+
+ // Time used as a reference point when filtering findings. The filter is
+ // limited to findings existing at the supplied time and their values are
+ // those at that specific time. Absence of this field will default to the
+ // API's version of NOW.
+ google.protobuf.Timestamp read_time = 4;
+
+ // When compare_duration is set, the GroupResult's "state_change" attribute is
+ // updated to indicate whether the finding had its state changed, the
+ // finding's state remained unchanged, or if the finding was added during the
+ // compare_duration period of time that precedes the read_time. This is the
+ // time between (read_time - compare_duration) and read_time.
+ //
+ // The state_change value is derived based on the presence and state of the
+ // finding at the two points in time. Intermediate state changes between the
+ // two times don't affect the result. For example, the results aren't affected
+ // if the finding is made inactive and then active again.
+ //
+ // Possible "state_change" values when compare_duration is specified:
+ //
+ // * "CHANGED": indicates that the finding was present at the start of
+ // compare_duration, but changed its state at read_time.
+ // * "UNCHANGED": indicates that the finding was present at the start of
+ // compare_duration and did not change state at read_time.
+ // * "ADDED": indicates that the finding was not present at the start
+ // of compare_duration, but was present at read_time.
+ //
+ // If compare_duration is not specified, then the only possible state_change
+ // is "UNUSED", which will be the state_change set for all findings present
+ // at read_time.
+ //
+ // If this field is set then `state_change` must be a specified field in
+ // `group_by`.
+ google.protobuf.Duration compare_duration = 5;
+
+ // The value returned by the last `GroupFindingsResponse`; indicates
+ // that this is a continuation of a prior `GroupFindings` call, and
+ // that the system should return the next page of data.
+ string page_token = 7;
+
+ // The maximum number of results to return in a single response. Default is
+ // 10, minimum is 1, maximum is 1000.
+ int32 page_size = 8;
+
+ reserved 6;
+}
+
+// Response message for group by findings.
+message GroupFindingsResponse {
+ // Group results. There exists an element for each existing unique
+ // combination of property/values. The element contains a count for the number
+ // of times those specific property/values appear.
+ repeated GroupResult group_by_results = 1;
+
+ // Time used for executing the groupBy request.
+ google.protobuf.Timestamp read_time = 2;
+
+ // Token to retrieve the next page of results, or empty if there are no more
+ // results.
+ string next_page_token = 3;
+
+ // The total number of results matching the query.
+ int32 total_size = 4;
+}
+
+// Result containing the properties and count of a groupBy request.
+message GroupResult {
+ // Properties matching the groupBy fields in the request.
+ map<string, google.protobuf.Value> properties = 1;
+
+ // Total count of resources for the given properties.
+ int64 count = 2;
+}
+
+// Request message for listing sources.
+message ListSourcesRequest {
+ // Resource name of the parent of sources to list. Its format should be
+ // "organizations/[organization_id]".
+ string parent = 1;
+
+ // The value returned by the last `ListSourcesResponse`; indicates
+ // that this is a continuation of a prior `ListSources` call, and
+ // that the system should return the next page of data.
+ string page_token = 2;
+
+ // The maximum number of results to return in a single response. Default is
+ // 10, minimum is 1, maximum is 1000.
+ int32 page_size = 7;
+}
+
+// Response message for listing sources.
+message ListSourcesResponse {
+ // Sources belonging to the requested parent.
+ repeated Source sources = 1;
+
+ // Token to retrieve the next page of results, or empty if there are no more
+ // results.
+ string next_page_token = 2;
+}
+
+// Request message for listing assets.
+message ListAssetsRequest {
+ // Name of the organization assets should belong to. Its format is
+ // "organizations/[organization_id]".
+ string parent = 1;
+
+ // Expression that defines the filter to apply across assets.
+ // The expression is a list of zero or more restrictions combined via logical
+ // operators `AND` and `OR`.
+ // Parentheses are supported, and `OR` has higher precedence than `AND`.
+ //
+ // Restrictions have the form `<field> <operator> <value>` and may have a `-`
+ // character in front of them to indicate negation. The fields map to those
+ // defined in the Asset resource. Examples include:
+ //
+ // * name
+ // * security_center_properties.resource_name
+ // * resource_properties.a_property
+ // * security_marks.marks.marka
+ //
+ // The supported operators are:
+ //
+ // * `=` for all value types.
+ // * `>`, `<`, `>=`, `<=` for integer values.
+ // * `:`, meaning substring matching, for strings.
+ //
+ // The supported value types are:
+ //
+ // * string literals in quotes.
+ // * integer literals without quotes.
+ // * boolean literals `true` and `false` without quotes.
+ //
+ // For example, `resource_properties.size = 100` is a valid filter string.
+ string filter = 2;
+
+ // Expression that defines what fields and order to use for sorting. The
+ // string value should follow SQL syntax: comma separated list of fields. For
+ // example: "name,resource_properties.a_property". The default sorting order
+ // is ascending. To specify descending order for a field, a suffix " desc"
+ // should be appended to the field name. For example: "name
+ // desc,resource_properties.a_property". Redundant space characters in the
+ // syntax are insignificant. "name desc,resource_properties.a_property" and "
+ // name desc , resource_properties.a_property " are equivalent.
+ string order_by = 3;
+
+ // Time used as a reference point when filtering assets. The filter is limited
+ // to assets existing at the supplied time and their values are those at that
+ // specific time. Absence of this field will default to the API's version of
+ // NOW.
+ google.protobuf.Timestamp read_time = 4;
+
+ // When compare_duration is set, the ListAssetsResult's "state_change"
+ // attribute is updated to indicate whether the asset was added, removed, or
+ // remained present during the compare_duration period of time that precedes
+ // the read_time. This is the time between (read_time - compare_duration) and
+ // read_time.
+ //
+ // The state_change value is derived based on the presence of the asset at the
+ // two points in time. Intermediate state changes between the two times don't
+ // affect the result. For example, the results aren't affected if the asset is
+ // removed and re-created again.
+ //
+ // Possible "state_change" values when compare_duration is specified:
+ //
+ // * "ADDED": indicates that the asset was not present at the start of
+ // compare_duration, but present at read_time.
+ // * "REMOVED": indicates that the asset was present at the start of
+ // compare_duration, but not present at read_time.
+ // * "ACTIVE": indicates that the asset was present at both the
+ // start and the end of the time period defined by
+ // compare_duration and read_time.
+ //
+ // If compare_duration is not specified, then the only possible state_change
+ // is "UNUSED", which will be the state_change set for all assets present at
+ // read_time.
+ google.protobuf.Duration compare_duration = 5;
+
+ // Optional.
+ //
+ // A field mask to specify the ListAssetsResult fields to be listed in the
+ // response.
+ // An empty field mask will list all fields.
+ google.protobuf.FieldMask field_mask = 7;
+
+ // The value returned by the last `ListAssetsResponse`; indicates
+ // that this is a continuation of a prior `ListAssets` call, and
+ // that the system should return the next page of data.
+ string page_token = 8;
+
+ // The maximum number of results to return in a single response. Default is
+ // 10, minimum is 1, maximum is 1000.
+ int32 page_size = 9;
+
+ reserved 6;
+}
+
+// Response message for listing assets.
+message ListAssetsResponse {
+ // Result containing the Asset and its State.
+ message ListAssetsResult {
+ // The change in state of the asset.
+ //
+ // When querying across two points in time this describes
+ // the change between the two points: ADDED, REMOVED, or ACTIVE.
+ // If there was no compare_duration supplied in the request the state change
+ // will be: UNUSED
+ enum StateChange {
+ // State change is unused, this is the canonical default for this enum.
+ UNUSED = 0;
+
+ // Asset was added between the points in time.
+ ADDED = 1;
+
+ // Asset was removed between the points in time.
+ REMOVED = 2;
+
+ // Asset was present at both point(s) in time.
+ ACTIVE = 3;
+ }
+
+ // Asset matching the search request.
+ Asset asset = 1;
+
+ // State change of the asset between the points in time.
+ StateChange state_change = 2;
+ }
+
+ // Assets matching the list request.
+ repeated ListAssetsResult list_assets_results = 1;
+
+ // Time used for executing the list request.
+ google.protobuf.Timestamp read_time = 2;
+
+ // Token to retrieve the next page of results, or empty if there are no more
+ // results.
+ string next_page_token = 3;
+
+ // The total number of assets matching the query.
+ int32 total_size = 4;
+}
+
+// Request message for listing findings.
+message ListFindingsRequest {
+ // Name of the source the findings belong to. Its format is
+ // "organizations/[organization_id]/sources/[source_id]". To list across all
+ // sources provide a source_id of `-`. For example:
+ // organizations/123/sources/-
+ string parent = 1;
+
+ // Expression that defines the filter to apply across findings.
+ // The expression is a list of one or more restrictions combined via logical
+ // operators `AND` and `OR`.
+ // Parentheses are supported, and `OR` has higher precedence than `AND`.
+ //
+ // Restrictions have the form `<field> <operator> <value>` and may have a `-`
+ // character in front of them to indicate negation. Examples include:
+ //
+ // * name
+ // * source_properties.a_property
+ // * security_marks.marks.marka
+ //
+ // The supported operators are:
+ //
+ // * `=` for all value types.
+ // * `>`, `<`, `>=`, `<=` for integer values.
+ // * `:`, meaning substring matching, for strings.
+ //
+ // The supported value types are:
+ //
+ // * string literals in quotes.
+ // * integer literals without quotes.
+ // * boolean literals `true` and `false` without quotes.
+ //
+ // For example, `source_properties.size = 100` is a valid filter string.
+ string filter = 2;
+
+ // Expression that defines what fields and order to use for sorting. The
+ // string value should follow SQL syntax: comma separated list of fields. For
+ // example: "name,resource_properties.a_property". The default sorting order
+ // is ascending. To specify descending order for a field, a suffix " desc"
+ // should be appended to the field name. For example: "name
+ // desc,source_properties.a_property". Redundant space characters in the
+ // syntax are insignificant. "name desc,source_properties.a_property" and "
+ // name desc , source_properties.a_property " are equivalent.
+ string order_by = 3;
+
+ // Time used as a reference point when filtering findings. The filter is
+ // limited to findings existing at the supplied time and their values are
+ // those at that specific time. Absence of this field will default to the
+ // API's version of NOW.
+ google.protobuf.Timestamp read_time = 4;
+
+ // When compare_duration is set, the ListFindingsResult's "state_change"
+ // attribute is updated to indicate whether the finding had its state changed,
+ // the finding's state remained unchanged, or if the finding was added in any
+ // state during the compare_duration period of time that precedes the
+ // read_time. This is the time between (read_time - compare_duration) and
+ // read_time.
+ //
+ // The state_change value is derived based on the presence and state of the
+ // finding at the two points in time. Intermediate state changes between the
+ // two times don't affect the result. For example, the results aren't affected
+ // if the finding is made inactive and then active again.
+ //
+ // Possible "state_change" values when compare_duration is specified:
+ //
+ // * "CHANGED": indicates that the finding was present at the start of
+ // compare_duration, but changed its state at read_time.
+ // * "UNCHANGED": indicates that the finding was present at the start of
+ // compare_duration and did not change state at read_time.
+ // * "ADDED": indicates that the finding was not present at the start
+ // of compare_duration, but was present at read_time.
+ //
+ // If compare_duration is not specified, then the only possible state_change
+ // is "UNUSED", which will be the state_change set for all findings present at
+ // read_time.
+ google.protobuf.Duration compare_duration = 5;
+
+ // Optional.
+ //
+ // A field mask to specify the Finding fields to be listed in the response.
+ // An empty field mask will list all fields.
+ google.protobuf.FieldMask field_mask = 7;
+
+ // The value returned by the last `ListFindingsResponse`; indicates
+ // that this is a continuation of a prior `ListFindings` call, and
+ // that the system should return the next page of data.
+ string page_token = 8;
+
+ // The maximum number of results to return in a single response. Default is
+ // 10, minimum is 1, maximum is 1000.
+ int32 page_size = 9;
+
+ reserved 6;
+}
+
+// Response message for listing findings.
+message ListFindingsResponse {
+ // Result containing the Finding and its StateChange.
+ message ListFindingsResult {
+ // The change in state of the finding.
+ //
+ // When querying across two points in time this describes
+ // the change in the finding between the two points: CHANGED, UNCHANGED,
+ // ADDED, or REMOVED. Findings can not be deleted, so REMOVED implies that
+ // the finding at timestamp does not match the filter specified, but it did
+ // at timestamp - compare_duration. If there was no compare_duration
+ // supplied in the request the state change will be: UNUSED
+ enum StateChange {
+ // State change is unused, this is the canonical default for this enum.
+ UNUSED = 0;
+
+ // The finding has changed state in some way between the points in time
+ // and existed at both points.
+ CHANGED = 1;
+
+ // The finding has not changed state between the points in time and
+ // existed at both points.
+ UNCHANGED = 2;
+
+ // The finding was created between the points in time.
+ ADDED = 3;
+
+ // The finding at timestamp does not match the filter specified, but it
+ // did at timestamp - compare_duration.
+ REMOVED = 4;
+ }
+
+ // Finding matching the search request.
+ Finding finding = 1;
+
+ // State change of the finding between the points in time.
+ StateChange state_change = 2;
+ }
+
+ // Findings matching the list request.
+ repeated ListFindingsResult list_findings_results = 1;
+
+ // Time used for executing the list request.
+ google.protobuf.Timestamp read_time = 2;
+
+ // Token to retrieve the next page of results, or empty if there are no more
+ // results.
+ string next_page_token = 3;
+
+ // The total number of findings matching the query.
+ int32 total_size = 4;
+}
+
+// Request message for updating a finding's state.
+message SetFindingStateRequest {
+ // The relative resource name of the finding. See:
+ // https://cloud.google.com/apis/design/resource_names#relative_resource_name
+ // Example:
+ // "organizations/123/sources/456/finding/789".
+ string name = 1;
+
+ // The desired State of the finding.
+ Finding.State state = 2;
+
+ // The time at which the updated state takes effect.
+ google.protobuf.Timestamp start_time = 3;
+}
+
+// Request message for running asset discovery for an organization.
+message RunAssetDiscoveryRequest {
+ // Name of the organization to run asset discovery for. Its format is
+ // "organizations/[organization_id]".
+ string parent = 1;
+}
+
+// Request message for updating or creating a finding.
+message UpdateFindingRequest {
+ // The finding resource to update or create if it does not already exist.
+ // parent, security_marks, and update_time will be ignored.
+ //
+ // In the case of creation, the finding id portion of the name must be
+ // alphanumeric and less than or equal to 32 characters and greater than 0
+ // characters in length.
+ Finding finding = 1;
+
+ // The FieldMask to use when updating the finding resource. This field should
+ // not be specified when creating a finding.
+ //
+ // When updating a finding, an empty mask is treated as updating all mutable
+ // fields and replacing source_properties. Individual source_properties can
+ // be added/updated by using "source_properties.<property key>" in the field
+ // mask.
+ google.protobuf.FieldMask update_mask = 2;
+}
+
+// Request message for updating an organization's settings.
+message UpdateOrganizationSettingsRequest {
+ // The organization settings resource to update.
+ OrganizationSettings organization_settings = 1;
+
+ // The FieldMask to use when updating the settings resource.
+ //
+ // If empty all mutable fields will be updated.
+ google.protobuf.FieldMask update_mask = 2;
+}
+
+// Request message for updating a source.
+message UpdateSourceRequest {
+ // The source resource to update.
+ Source source = 1;
+
+ // The FieldMask to use when updating the source resource.
+ //
+ // If empty all mutable fields will be updated.
+ google.protobuf.FieldMask update_mask = 2;
+}
+
+// Request message for updating a SecurityMarks resource.
+message UpdateSecurityMarksRequest {
+ // The security marks resource to update.
+ SecurityMarks security_marks = 1;
+
+ // The FieldMask to use when updating the security marks resource.
+ //
+ // The field mask must not contain duplicate fields.
+ // If empty or set to "marks", all marks will be replaced. Individual
+ // marks can be updated using "marks.<mark_key>".
+ google.protobuf.FieldMask update_mask = 2;
+
+ // The time at which the updated SecurityMarks take effect.
+ // If not set uses current server time. Updates will be applied to the
+ // SecurityMarks that are active immediately preceding this time.
+ google.protobuf.Timestamp start_time = 3;
+}
git://repos.xcallymotion.com / motion2.git / blobdiff