Response message for simulating a SecurityHealthAnalyticsCustomModule
against a given resource.
JSON representation |
---|
{
"result": {
object ( |
Fields | |
---|---|
result |
Result for test case in the corresponding request. |
SimulatedResult
Possible test result.
JSON representation |
---|
{ // Union field |
Fields | |
---|---|
Union field
|
|
finding |
Finding that would be published for the test case, if a violation is detected. |
noViolation |
Indicates that the test case does not trigger any violation. |
error |
Error encountered during the test. |
SimulatedFinding
A subset of the fields of the Security Center Finding proto. The minimum set of fields needed to represent a simulated finding from a SHA custom module.
JSON representation |
---|
{ "name": string, "parent": string, "resourceName": string, "category": string, "state": enum ( |
Fields | |
---|---|
name |
Identifier. The relative resource name of the finding. Example: "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}", "projects/{projectId}/sources/{source_id}/findings/{finding_id}". |
parent |
The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/{organization_id}/sources/{source_id}" |
resourceName |
For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time. |
category |
The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION" |
state |
Output only. The state of the finding. |
sourceProperties |
Source specific properties. These properties are managed by the source that writes the finding. The key names in the sourceProperties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only. An object containing a list of |
eventTime |
The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
severity |
The severity of the finding. This field is managed by the source that writes the finding. |
findingClass |
The class of the finding. |
State
The state of the finding.
Enums | |
---|---|
STATE_UNSPECIFIED |
Unspecified state. |
ACTIVE |
The finding requires attention and has not been addressed yet. |
INACTIVE |
The finding has been fixed, triaged as a non-issue or otherwise addressed and is no longer active. |
Severity
The severity of the finding.
Enums | |
---|---|
SEVERITY_UNSPECIFIED |
This value is used for findings when a source doesn't write a severity value. |
CRITICAL |
Vulnerability: A critical vulnerability is easily discoverable by an external actor, exploitable, and results in the direct ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. Examples include publicly accessible unprotected user data and public SSH access with weak or no passwords. Threat: Indicates a threat that is able to access, modify, or delete data or execute unauthorized code within existing resources. |
HIGH |
Vulnerability: A high risk vulnerability can be easily discovered and exploited in combination with other vulnerabilities in order to gain direct access and the ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. An example is a database with weak or no passwords that is only accessible internally. This database could easily be compromised by an actor that had access to the internal network. Threat: Indicates a threat that is able to create new computational resources in an environment but not able to access data or execute code in existing resources. |
MEDIUM |
Vulnerability: A medium risk vulnerability could be used by an actor to gain access to resources or privileges that enable them to eventually (through multiple steps or a complex exploit) gain access and the ability to execute arbitrary code or exfiltrate data. An example is a service account with access to more projects than it should have. If an actor gains access to the service account, they could potentially use that access to manipulate a project the service account was not intended to. Threat: Indicates a threat that is able to cause operational impact but may not access data or execute unauthorized code. |
LOW |
Vulnerability: A low risk vulnerability hampers a security organization's ability to detect vulnerabilities or active threats in their deployment, or prevents the root cause investigation of security issues. An example is monitoring and logs being disabled for resource configurations and access. Threat: Indicates a threat that has obtained minimal access to an environment but is not able to access data, execute code, or create resources. |
FindingClass
Represents what kind of Finding it is.
Enums | |
---|---|
FINDING_CLASS_UNSPECIFIED |
Unspecified finding class. |
THREAT |
Describes unwanted or malicious activity. |
VULNERABILITY |
Describes a potential weakness in software that increases risk to Confidentiality & Integrity & Availability. |
MISCONFIGURATION |
Describes a potential weakness in cloud resource/asset configuration that increases risk. |
OBSERVATION |
Describes a security observation that is for informational purposes. |
SCC_ERROR |
Describes an error that prevents some SCC functionality. |
POSTURE_VIOLATION |
Describes a potential security risk due to a change in the security posture. |
Status
The Status
type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status
message contains three pieces of data: error code, error message, and error details.
You can find out more about this error model and how to work with it in the API Design Guide.
JSON representation |
---|
{ "code": integer, "message": string, "details": [ { "@type": string, field1: ..., ... } ] } |
Fields | |
---|---|
code |
The status code, which should be an enum value of |
message |
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the |
details[] |
A list of messages that carry the error details. There is a common set of message types for APIs to use. An object containing fields of an arbitrary type. An additional field |