Reference documentation and code samples for the Google Cloud Security Command Center V1 Client class Finding.
Security Command Center finding.
A finding is a record of assessment data like security, risk, health, or privacy, that is ingested into Security Command Center for presentation, notification, analysis, policy testing, and enforcement. For example, a cross-site scripting (XSS) vulnerability in an App Engine application is a finding.
Generated from protobuf message google.cloud.securitycenter.v1.Finding
Methods
__construct
Constructor.
data
array
Optional. Data for populating the Message object.
↳ name
string
The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}"
↳ parent
string
The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/{organization_id}/sources/{source_id}"
↳ resource_name
string
For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time.
↳ state
int
The state of the finding.
↳ category
string
The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"
↳ external_uri
string
The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.
↳ source_properties
array|Google\Protobuf\Internal\MapField
Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.
↳ security_marks
Google\Cloud\SecurityCenter\V1\SecurityMarks
Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
↳ event_time
Google\Protobuf\Timestamp
The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.
↳ create_time
Google\Protobuf\Timestamp
The time at which the finding was created in Security Command Center.
↳ severity
int
The severity of the finding. This field is managed by the source that writes the finding.
↳ canonical_name
string
The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or "projects/{project_number}/sources/{source_id}/findings/{finding_id}", depending on the closest CRM ancestor of the resource associated with the finding.
↳ mute
int
Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
↳ finding_class
int
The class of the finding.
↳ indicator
Google\Cloud\SecurityCenter\V1\Indicator
Represents what's commonly known as an Indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
↳ vulnerability
Google\Cloud\SecurityCenter\V1\Vulnerability
Represents vulnerability-specific fields like CVE and CVS scores. CVE stands for Common Vulnerabilities and Exposures ( https://cve.mitre.org/about/ )
↳ mute_update_time
Google\Protobuf\Timestamp
Output only. The most recent time this finding was muted or unmuted.
↳ external_systems
array|Google\Protobuf\Internal\MapField
Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.
↳ mitre_attack
Google\Cloud\SecurityCenter\V1\MitreAttack
MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org
↳ access
Google\Cloud\SecurityCenter\V1\Access
Access details associated to the Finding, such as more information on the caller, which method was accessed, from where, etc.
↳ connections
array< Google\Cloud\SecurityCenter\V1\Connection
>
Contains information about the IP connection associated with the finding.
↳ mute_initiator
string
First known as mute_annotation. Records additional information about the mute operation e.g. mute config that muted the finding, user who muted the finding, etc. Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
↳ processes
array< Google\Cloud\SecurityCenter\V1\Process
>
Represents operating system processes associated with the Finding.
↳ contacts
array|Google\Protobuf\Internal\MapField
Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories { "security": { "contacts": [ { "email": "person1@company.com" }, { "email": "person2@company.com" } ] } }
↳ compliances
array< Google\Cloud\SecurityCenter\V1\Compliance
>
Contains compliance information for security standards associated to the finding.
↳ parent_display_name
string
Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
↳ description
string
Contains more detail about the finding.
↳ exfiltration
↳ iam_bindings
array< Google\Cloud\SecurityCenter\V1\IamBinding
>
Represents IAM bindings associated with the Finding.
↳ next_steps
string
Next steps associate to the finding.
↳ containers
array< Google\Cloud\SecurityCenter\V1\Container
>
Containers associated with the finding. containers provides information for both Kubernetes and non-Kubernetes containers.
↳ kubernetes
↳ database
↳ files
↳ kernel_rootkit
getName
The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}"
Generated from protobuf field string name = 1;
string
setName
The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}"
Generated from protobuf field string name = 1;
var
string
$this
getParent
The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time.
For example: "organizations/{organization_id}/sources/{source_id}"
Generated from protobuf field string parent = 2;
string
setParent
The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time.
For example: "organizations/{organization_id}/sources/{source_id}"
Generated from protobuf field string parent = 2;
var
string
$this
getResourceName
For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time.
Generated from protobuf field string resource_name = 3;
string
setResourceName
For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time.
Generated from protobuf field string resource_name = 3;
var
string
$this
getState
The state of the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Finding.State state = 4;
int
setState
The state of the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Finding.State state = 4;
var
int
$this
getCategory
The additional taxonomy group within findings from a given source.
This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"
Generated from protobuf field string category = 5;
string
setCategory
The additional taxonomy group within findings from a given source.
This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"
Generated from protobuf field string category = 5;
var
string
$this
getExternalUri
The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found.
This field is guaranteed to be either empty or a well formed URL.
Generated from protobuf field string external_uri = 6;
string
setExternalUri
The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found.
This field is guaranteed to be either empty or a well formed URL.
Generated from protobuf field string external_uri = 6;
var
string
$this
getSourceProperties
Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.
Generated from protobuf field map<string, .google.protobuf.Value> source_properties = 7;
Google\Protobuf\Internal\MapField
setSourceProperties
Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.
Generated from protobuf field map<string, .google.protobuf.Value> source_properties = 7;
var
array|Google\Protobuf\Internal\MapField
$this
getSecurityMarks
Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.SecurityMarks security_marks = 8 [(.google.api.field_behavior) = OUTPUT_ONLY];
hasSecurityMarks
clearSecurityMarks
setSecurityMarks
Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.SecurityMarks security_marks = 8 [(.google.api.field_behavior) = OUTPUT_ONLY];
$this
getEventTime
The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred.
For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.
Generated from protobuf field .google.protobuf.Timestamp event_time = 9;
Google\Protobuf\Timestamp|null
hasEventTime
clearEventTime
setEventTime
The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred.
For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.
Generated from protobuf field .google.protobuf.Timestamp event_time = 9;
var
Google\Protobuf\Timestamp
$this
getCreateTime
The time at which the finding was created in Security Command Center.
Generated from protobuf field .google.protobuf.Timestamp create_time = 10;
Google\Protobuf\Timestamp|null
hasCreateTime
clearCreateTime
setCreateTime
The time at which the finding was created in Security Command Center.
Generated from protobuf field .google.protobuf.Timestamp create_time = 10;
var
Google\Protobuf\Timestamp
$this
getSeverity
The severity of the finding. This field is managed by the source that writes the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Finding.Severity severity = 12;
int
setSeverity
The severity of the finding. This field is managed by the source that writes the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Finding.Severity severity = 12;
var
int
$this
getCanonicalName
The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or "projects/{project_number}/sources/{source_id}/findings/{finding_id}", depending on the closest CRM ancestor of the resource associated with the finding.
Generated from protobuf field string canonical_name = 14;
string
setCanonicalName
The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or "projects/{project_number}/sources/{source_id}/findings/{finding_id}", depending on the closest CRM ancestor of the resource associated with the finding.
Generated from protobuf field string canonical_name = 14;
var
string
$this
getMute
Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
Generated from protobuf field .google.cloud.securitycenter.v1.Finding.Mute mute = 15;
int
setMute
Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
Generated from protobuf field .google.cloud.securitycenter.v1.Finding.Mute mute = 15;
var
int
$this
getFindingClass
The class of the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Finding.FindingClass finding_class = 17;
int
setFindingClass
The class of the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Finding.FindingClass finding_class = 17;
var
int
$this
getIndicator
Represents what's commonly known as an Indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion.
Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
Generated from protobuf field .google.cloud.securitycenter.v1.Indicator indicator = 18;
hasIndicator
clearIndicator
setIndicator
Represents what's commonly known as an Indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion.
Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
Generated from protobuf field .google.cloud.securitycenter.v1.Indicator indicator = 18;
$this
getVulnerability
Represents vulnerability-specific fields like CVE and CVS scores.
CVE stands for Common Vulnerabilities and Exposures ( https://cve.mitre.org/about/ )
Generated from protobuf field .google.cloud.securitycenter.v1.Vulnerability vulnerability = 20;
hasVulnerability
clearVulnerability
setVulnerability
Represents vulnerability-specific fields like CVE and CVS scores.
CVE stands for Common Vulnerabilities and Exposures ( https://cve.mitre.org/about/ )
Generated from protobuf field .google.cloud.securitycenter.v1.Vulnerability vulnerability = 20;
$this
getMuteUpdateTime
Output only. The most recent time this finding was muted or unmuted.
Generated from protobuf field .google.protobuf.Timestamp mute_update_time = 21 [(.google.api.field_behavior) = OUTPUT_ONLY];
Google\Protobuf\Timestamp|null
hasMuteUpdateTime
clearMuteUpdateTime
setMuteUpdateTime
Output only. The most recent time this finding was muted or unmuted.
Generated from protobuf field .google.protobuf.Timestamp mute_update_time = 21 [(.google.api.field_behavior) = OUTPUT_ONLY];
var
Google\Protobuf\Timestamp
$this
getExternalSystems
Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.
Generated from protobuf field map<string, .google.cloud.securitycenter.v1.ExternalSystem> external_systems = 22 [(.google.api.field_behavior) = OUTPUT_ONLY];
Google\Protobuf\Internal\MapField
setExternalSystems
Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.
Generated from protobuf field map<string, .google.cloud.securitycenter.v1.ExternalSystem> external_systems = 22 [(.google.api.field_behavior) = OUTPUT_ONLY];
var
array|Google\Protobuf\Internal\MapField
$this
getMitreAttack
MITRE ATT&CK tactics and techniques related to this finding.
Generated from protobuf field .google.cloud.securitycenter.v1.MitreAttack mitre_attack = 25;
hasMitreAttack
clearMitreAttack
setMitreAttack
MITRE ATT&CK tactics and techniques related to this finding.
Generated from protobuf field .google.cloud.securitycenter.v1.MitreAttack mitre_attack = 25;
$this
getAccess
Access details associated to the Finding, such as more information on the caller, which method was accessed, from where, etc.
Generated from protobuf field .google.cloud.securitycenter.v1.Access access = 26;
hasAccess
clearAccess
setAccess
Access details associated to the Finding, such as more information on the caller, which method was accessed, from where, etc.
Generated from protobuf field .google.cloud.securitycenter.v1.Access access = 26;
$this
getConnections
Contains information about the IP connection associated with the finding.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.Connection connections = 31;
Google\Protobuf\Internal\RepeatedField
setConnections
Contains information about the IP connection associated with the finding.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.Connection connections = 31;
$this
getMuteInitiator
First known as mute_annotation. Records additional information about the mute operation e.g. mute config that muted the finding, user who muted the finding, etc. Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
Generated from protobuf field string mute_initiator = 28;
string
setMuteInitiator
First known as mute_annotation. Records additional information about the mute operation e.g. mute config that muted the finding, user who muted the finding, etc. Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
Generated from protobuf field string mute_initiator = 28;
var
string
$this
getProcesses
Represents operating system processes associated with the Finding.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.Process processes = 30;
Google\Protobuf\Internal\RepeatedField
setProcesses
Represents operating system processes associated with the Finding.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.Process processes = 30;
$this
getContacts
Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories { "security": { "contacts": [ { "email": "person1@company.com" }, { "email": "person2@company.com" } ] } }
Generated from protobuf field map<string, .google.cloud.securitycenter.v1.ContactDetails> contacts = 33 [(.google.api.field_behavior) = OUTPUT_ONLY];
Google\Protobuf\Internal\MapField
setContacts
Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories { "security": { "contacts": [ { "email": "person1@company.com" }, { "email": "person2@company.com" } ] } }
Generated from protobuf field map<string, .google.cloud.securitycenter.v1.ContactDetails> contacts = 33 [(.google.api.field_behavior) = OUTPUT_ONLY];
var
array|Google\Protobuf\Internal\MapField
$this
getCompliances
Contains compliance information for security standards associated to the finding.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.Compliance compliances = 34;
Google\Protobuf\Internal\RepeatedField
setCompliances
Contains compliance information for security standards associated to the finding.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.Compliance compliances = 34;
$this
getParentDisplayName
Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
Generated from protobuf field string parent_display_name = 36 [(.google.api.field_behavior) = OUTPUT_ONLY];
string
setParentDisplayName
Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
Generated from protobuf field string parent_display_name = 36 [(.google.api.field_behavior) = OUTPUT_ONLY];
var
string
$this
getDescription
Contains more detail about the finding.
Generated from protobuf field string description = 37;
string
setDescription
Contains more detail about the finding.
Generated from protobuf field string description = 37;
var
string
$this
getExfiltration
Represents exfiltration associated with the Finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Exfiltration exfiltration = 38;
hasExfiltration
clearExfiltration
setExfiltration
Represents exfiltration associated with the Finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Exfiltration exfiltration = 38;
$this
getIamBindings
Represents IAM bindings associated with the Finding.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.IamBinding iam_bindings = 39;
Google\Protobuf\Internal\RepeatedField
setIamBindings
Represents IAM bindings associated with the Finding.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.IamBinding iam_bindings = 39;
$this
getNextSteps
Next steps associate to the finding.
Generated from protobuf field string next_steps = 40;
string
setNextSteps
Next steps associate to the finding.
Generated from protobuf field string next_steps = 40;
var
string
$this
getContainers
Containers associated with the finding. containers provides information for both Kubernetes and non-Kubernetes containers.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.Container containers = 42;
Google\Protobuf\Internal\RepeatedField
setContainers
Containers associated with the finding. containers provides information for both Kubernetes and non-Kubernetes containers.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.Container containers = 42;
$this
getKubernetes
Kubernetes resources associated with the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Kubernetes kubernetes = 43;
hasKubernetes
clearKubernetes
setKubernetes
Kubernetes resources associated with the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Kubernetes kubernetes = 43;
$this
getDatabase
Database associated with the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Database database = 44;
hasDatabase
clearDatabase
setDatabase
Database associated with the finding.
Generated from protobuf field .google.cloud.securitycenter.v1.Database database = 44;
$this
getFiles
File associated with the finding.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.File files = 46;
Google\Protobuf\Internal\RepeatedField
setFiles
File associated with the finding.
Generated from protobuf field repeated .google.cloud.securitycenter.v1.File files = 46;
$this
getKernelRootkit
Kernel Rootkit signature.
Generated from protobuf field .google.cloud.securitycenter.v1.KernelRootkit kernel_rootkit = 50;
hasKernelRootkit
clearKernelRootkit
setKernelRootkit
Kernel Rootkit signature.
Generated from protobuf field .google.cloud.securitycenter.v1.KernelRootkit kernel_rootkit = 50;
$this
