Reference documentation and code samples for the Google Cloud Security Command Center V2 Client class Finding.
Security Command Center finding.
A finding is a record of assessment data like security, risk, health, or privacy, that is ingested into Security Command Center for presentation, notification, analysis, policy testing, and enforcement. For example, a cross-site scripting (XSS) vulnerability in an App Engine application is a finding.
Generated from protobuf message google.cloud.securitycenter.v2.Finding
Namespace
Google \ Cloud \ SecurityCenter \ V2Methods
__construct
Constructor.
data
array
Optional. Data for populating the Message object.
↳ name
string
The relative resource name
of the finding. The following list shows some examples: + organizations/{organization_id}/sources/{source_id}/findings/{finding_id}
+ organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
+ folders/{folder_id}/sources/{source_id}/findings/{finding_id}
+ folders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
+ projects/{project_id}/sources/{source_id}/findings/{finding_id}
+ projects/{project_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
↳ canonical_name
string
Output only. The canonical name of the finding. The following list shows some examples: + organizations/{organization_id}/sources/{source_id}/findings/{finding_id}
+ organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
+ folders/{folder_id}/sources/{source_id}/findings/{finding_id}
+ folders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
+ projects/{project_id}/sources/{source_id}/findings/{finding_id}
+ projects/{project_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
The prefix is the closest CRM ancestor of the resource associated with the finding.
↳ parent
string
The relative resource name of the source and location the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name
This field is immutable after creation time. The following list shows some examples: + organizations/{organization_id}/sources/{source_id}
+ folders/{folders_id}/sources/{source_id}
+ projects/{projects_id}/sources/{source_id}
+ organizations/{organization_id}/sources/{source_id}/locations/{location_id}
+ folders/{folders_id}/sources/{source_id}/locations/{location_id}
+ projects/{projects_id}/sources/{source_id}/locations/{location_id}
↳ resource_name
string
Immutable. For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string.
↳ state
int
Output only. The state of the finding.
↳ category
string
Immutable. The additional taxonomy group within findings from a given source. Example: "XSS_FLASH_INJECTION"
↳ external_uri
string
The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.
↳ source_properties
array| Google\Protobuf\Internal\MapField
Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.
↳ security_marks
SecurityMarks
Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
↳ event_time
Google\Protobuf\Timestamp
The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.
↳ create_time
Google\Protobuf\Timestamp
Output only. The time at which the finding was created in Security Command Center.
↳ severity
int
The severity of the finding. This field is managed by the source that writes the finding.
↳ mute
int
Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
↳ mute_info
↳ finding_class
int
The class of the finding.
↳ indicator
Indicator
Represents what's commonly known as an indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. For more information, see Indicator of compromise .
↳ vulnerability
Vulnerability
Represents vulnerability-specific fields like CVE and CVSS scores. CVE stands for Common Vulnerabilities and Exposures ( https://cve.mitre.org/about/ )
↳ mute_update_time
↳ external_systems
array| Google\Protobuf\Internal\MapField
Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.
↳ mitre_attack
MitreAttack
MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org
↳ access
Access
Access details associated with the finding, such as more information on the caller, which method was accessed, and from where.
↳ connections
↳ mute_initiator
string
Records additional information about the mute operation, for example, the mute configuration that muted the finding and the user who muted the finding.
↳ processes
↳ contacts
array| Google\Protobuf\Internal\MapField
Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories { "security": { "contacts": [ { "email": "person1@company.com" }, { "email": "person2@company.com" } ] } }
↳ compliances
array< Compliance
>
Contains compliance information for security standards associated to the finding.
↳ parent_display_name
string
Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
↳ description
string
Contains more details about the finding.
↳ exfiltration
↳ iam_bindings
↳ next_steps
string
Steps to address the finding.
↳ module_name
string
Unique identifier of the module which generated the finding. Example: folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885
↳ containers
array< Container
>
Containers associated with the finding. This field provides information for both Kubernetes and non-Kubernetes containers.
↳ kubernetes
↳ database
↳ attack_exposure
↳ files
↳ cloud_dlp_inspection
CloudDlpInspection
Cloud Data Loss Prevention (Cloud DLP) inspection results that are associated with the finding.
↳ cloud_dlp_data_profile
↳ kernel_rootkit
↳ org_policies
↳ application
↳ backup_disaster_recovery
↳ security_posture
↳ log_entries
↳ load_balancers
↳ cloud_armor
↳ notebook
↳ toxic_combination
ToxicCombination
Contains details about a group of security issues that, when the issues occur together, represent a greater risk than when the issues occur independently. A group of such issues is referred to as a toxic combination. This field cannot be updated. Its value is ignored in all update requests.
↳ group_memberships
array< GroupMembership
>
Contains details about groups of which this finding is a member. A group is a collection of findings that are related in some way. This field cannot be updated. Its value is ignored in all update requests.
↳ disk
↳ data_access_events
↳ data_flow_events
↳ data_retention_deletion_events
getName
The relative resource
name
of the finding. The following list shows some examples:
+ organizations/{organization_id}/sources/{source_id}/findings/{finding_id}
+ organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
-
folders/{folder_id}/sources/{source_id}/findings/{finding_id}+folders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id} -
projects/{project_id}/sources/{source_id}/findings/{finding_id}+projects/{project_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
string
setName
The relative resource
name
of the finding. The following list shows some examples:
+ organizations/{organization_id}/sources/{source_id}/findings/{finding_id}
+ organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
-
folders/{folder_id}/sources/{source_id}/findings/{finding_id}+folders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id} -
projects/{project_id}/sources/{source_id}/findings/{finding_id}+projects/{project_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
var
string
$this
getCanonicalName
Output only. The canonical name of the finding. The following list shows
some examples:
+ organizations/{organization_id}/sources/{source_id}/findings/{finding_id}
+ organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
-
folders/{folder_id}/sources/{source_id}/findings/{finding_id}+folders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id} -
projects/{project_id}/sources/{source_id}/findings/{finding_id}+projects/{project_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}The prefix is the closest CRM ancestor of the resource associated with the finding.
string
setCanonicalName
Output only. The canonical name of the finding. The following list shows
some examples:
+ organizations/{organization_id}/sources/{source_id}/findings/{finding_id}
+ organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
-
folders/{folder_id}/sources/{source_id}/findings/{finding_id}+folders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id} -
projects/{project_id}/sources/{source_id}/findings/{finding_id}+projects/{project_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}The prefix is the closest CRM ancestor of the resource associated with the finding.
var
string
$this
getParent
The relative resource name of the source and location the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. The following list shows some examples:
-
organizations/{organization_id}/sources/{source_id} -
folders/{folders_id}/sources/{source_id} -
projects/{projects_id}/sources/{source_id}+organizations/{organization_id}/sources/{source_id}/locations/{location_id} -
folders/{folders_id}/sources/{source_id}/locations/{location_id} -
projects/{projects_id}/sources/{source_id}/locations/{location_id}
string
setParent
The relative resource name of the source and location the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. The following list shows some examples:
-
organizations/{organization_id}/sources/{source_id} -
folders/{folders_id}/sources/{source_id} -
projects/{projects_id}/sources/{source_id}+organizations/{organization_id}/sources/{source_id}/locations/{location_id} -
folders/{folders_id}/sources/{source_id}/locations/{location_id} -
projects/{projects_id}/sources/{source_id}/locations/{location_id}
var
string
$this
getResourceName
Immutable. For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string.
string
setResourceName
Immutable. For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string.
var
string
$this
getState
Output only. The state of the finding.
int
setState
Output only. The state of the finding.
var
int
$this
getCategory
Immutable. The additional taxonomy group within findings from a given source. Example: "XSS_FLASH_INJECTION"
string
setCategory
Immutable. The additional taxonomy group within findings from a given source. Example: "XSS_FLASH_INJECTION"
var
string
$this
getExternalUri
The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found.
This field is guaranteed to be either empty or a well formed URL.
string
setExternalUri
The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found.
This field is guaranteed to be either empty or a well formed URL.
var
string
$this
getSourceProperties
Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.
setSourceProperties
Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.
$this
getSecurityMarks
Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
hasSecurityMarks
clearSecurityMarks
setSecurityMarks
Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
$this
getEventTime
The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred.
For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.
hasEventTime
clearEventTime
setEventTime
The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred.
For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.
$this
getCreateTime
Output only. The time at which the finding was created in Security Command Center.
hasCreateTime
clearCreateTime
setCreateTime
Output only. The time at which the finding was created in Security Command Center.
$this
getSeverity
The severity of the finding. This field is managed by the source that writes the finding.
int
setSeverity
The severity of the finding. This field is managed by the source that writes the finding.
var
int
$this
getMute
Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
int
setMute
Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
var
int
$this
getMuteInfo
Output only. The mute information regarding this finding.
hasMuteInfo
clearMuteInfo
setMuteInfo
Output only. The mute information regarding this finding.
$this
getFindingClass
The class of the finding.
int
setFindingClass
The class of the finding.
var
int
$this
getIndicator
Represents what's commonly known as an indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. For more information, see Indicator of compromise .
hasIndicator
clearIndicator
setIndicator
Represents what's commonly known as an indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. For more information, see Indicator of compromise .
$this
getVulnerability
Represents vulnerability-specific fields like CVE and CVSS scores.
CVE stands for Common Vulnerabilities and Exposures ( https://cve.mitre.org/about/ )
hasVulnerability
clearVulnerability
setVulnerability
Represents vulnerability-specific fields like CVE and CVSS scores.
CVE stands for Common Vulnerabilities and Exposures ( https://cve.mitre.org/about/ )
$this
getMuteUpdateTime
Output only. The most recent time this finding was muted or unmuted.
hasMuteUpdateTime
clearMuteUpdateTime
setMuteUpdateTime
Output only. The most recent time this finding was muted or unmuted.
$this
getExternalSystems
Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.
setExternalSystems
Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.
$this
getMitreAttack
MITRE ATT&CK tactics and techniques related to this finding.
hasMitreAttack
clearMitreAttack
setMitreAttack
MITRE ATT&CK tactics and techniques related to this finding.
$this
getAccess
Access details associated with the finding, such as more information on the caller, which method was accessed, and from where.
hasAccess
clearAccess
setAccess
Access details associated with the finding, such as more information on the caller, which method was accessed, and from where.
$this
getConnections
Contains information about the IP connection associated with the finding.
setConnections
Contains information about the IP connection associated with the finding.
$this
getMuteInitiator
Records additional information about the mute operation, for example, the mute configuration that muted the finding and the user who muted the finding.
string
setMuteInitiator
Records additional information about the mute operation, for example, the mute configuration that muted the finding and the user who muted the finding.
var
string
$this
getProcesses
Represents operating system processes associated with the Finding.
setProcesses
Represents operating system processes associated with the Finding.
$this
getContacts
Output only. Map containing the points of contact for the given finding.
The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories { "security": { "contacts": [ { "email": "person1@company.com" }, { "email": "person2@company.com" } ] } }
setContacts
Output only. Map containing the points of contact for the given finding.
The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories { "security": { "contacts": [ { "email": "person1@company.com" }, { "email": "person2@company.com" } ] } }
$this
getCompliances
Contains compliance information for security standards associated to the finding.
setCompliances
Contains compliance information for security standards associated to the finding.
$this
getParentDisplayName
Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
string
setParentDisplayName
Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
var
string
$this
getDescription
Contains more details about the finding.
string
setDescription
Contains more details about the finding.
var
string
$this
getExfiltration
Represents exfiltrations associated with the finding.
hasExfiltration
clearExfiltration
setExfiltration
Represents exfiltrations associated with the finding.
$this
getIamBindings
Represents IAM bindings associated with the finding.
setIamBindings
Represents IAM bindings associated with the finding.
$this
getNextSteps
Steps to address the finding.
string
setNextSteps
Steps to address the finding.
var
string
$this
getModuleName
Unique identifier of the module which generated the finding.
Example: folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885
string
setModuleName
Unique identifier of the module which generated the finding.
Example: folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885
var
string
$this
getContainers
Containers associated with the finding. This field provides information for both Kubernetes and non-Kubernetes containers.
setContainers
Containers associated with the finding. This field provides information for both Kubernetes and non-Kubernetes containers.
$this
getKubernetes
Kubernetes resources associated with the finding.
hasKubernetes
clearKubernetes
setKubernetes
Kubernetes resources associated with the finding.
$this
getDatabase
Database associated with the finding.
hasDatabase
clearDatabase
setDatabase
Database associated with the finding.
$this
getAttackExposure
The results of an attack path simulation relevant to this finding.
hasAttackExposure
clearAttackExposure
setAttackExposure
The results of an attack path simulation relevant to this finding.
$this
getFiles
File associated with the finding.
setFiles
File associated with the finding.
$this
getCloudDlpInspection
Cloud Data Loss Prevention (Cloud DLP) inspection results that are associated with the finding.
hasCloudDlpInspection
clearCloudDlpInspection
setCloudDlpInspection
Cloud Data Loss Prevention (Cloud DLP) inspection results that are associated with the finding.
$this
getCloudDlpDataProfile
Cloud DLP data profile that is associated with the finding.
hasCloudDlpDataProfile
clearCloudDlpDataProfile
setCloudDlpDataProfile
Cloud DLP data profile that is associated with the finding.
$this
getKernelRootkit
Signature of the kernel rootkit.
hasKernelRootkit
clearKernelRootkit
setKernelRootkit
Signature of the kernel rootkit.
$this
getOrgPolicies
Contains information about the org policies associated with the finding.
setOrgPolicies
Contains information about the org policies associated with the finding.
$this
getApplication
Represents an application associated with the finding.
hasApplication
clearApplication
setApplication
Represents an application associated with the finding.
$this
getBackupDisasterRecovery
Fields related to Backup and DR findings.
hasBackupDisasterRecovery
clearBackupDisasterRecovery
setBackupDisasterRecovery
Fields related to Backup and DR findings.
$this
getSecurityPosture
The security posture associated with the finding.
hasSecurityPosture
clearSecurityPosture
setSecurityPosture
The security posture associated with the finding.
$this
getLogEntries
Log entries that are relevant to the finding.
setLogEntries
Log entries that are relevant to the finding.
$this
getLoadBalancers
The load balancers associated with the finding.
setLoadBalancers
The load balancers associated with the finding.
$this
getCloudArmor
Fields related to Cloud Armor findings.
hasCloudArmor
clearCloudArmor
setCloudArmor
Fields related to Cloud Armor findings.
$this
getNotebook
Notebook associated with the finding.
hasNotebook
clearNotebook
setNotebook
Notebook associated with the finding.
$this
getToxicCombination
Contains details about a group of security issues that, when the issues occur together, represent a greater risk than when the issues occur independently. A group of such issues is referred to as a toxic combination.
This field cannot be updated. Its value is ignored in all update requests.
hasToxicCombination
clearToxicCombination
setToxicCombination
Contains details about a group of security issues that, when the issues occur together, represent a greater risk than when the issues occur independently. A group of such issues is referred to as a toxic combination.
This field cannot be updated. Its value is ignored in all update requests.
$this
getGroupMemberships
Contains details about groups of which this finding is a member. A group is a collection of findings that are related in some way.
This field cannot be updated. Its value is ignored in all update requests.
setGroupMemberships
Contains details about groups of which this finding is a member. A group is a collection of findings that are related in some way.
This field cannot be updated. Its value is ignored in all update requests.
$this
getDisk
Disk associated with the finding.
hasDisk
clearDisk
setDisk
Disk associated with the finding.
$this
getDataAccessEvents
Data access events associated with the finding.
setDataAccessEvents
Data access events associated with the finding.
$this
getDataFlowEvents
Data flow events associated with the finding.
setDataFlowEvents
Data flow events associated with the finding.
$this
getDataRetentionDeletionEvents
Data retention deletion events associated with the finding.
setDataRetentionDeletionEvents
Data retention deletion events associated with the finding.
$this
