Reference documentation and code samples for the Google Cloud Security Command Center V1 Client class Finding.
Security Command Center finding.
A finding is a record of assessment data like security, risk, health, or privacy, that is ingested into Security Command Center for presentation, notification, analysis, policy testing, and enforcement. For example, a cross-site scripting (XSS) vulnerability in an App Engine application is a finding.
Generated from protobuf message google.cloud.securitycenter.v1.Finding
Methods
__construct
Constructor.
data
array
Optional. Data for populating the Message object.
↳ name
string
The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}"
↳ parent
string
The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/{organization_id}/sources/{source_id}"
↳ resource_name
string
For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time.
↳ state
int
The state of the finding.
↳ category
string
The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"
↳ external_uri
string
The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.
↳ source_properties
array| Google\Protobuf\Internal\MapField
Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.
↳ security_marks
Google\Cloud\SecurityCenter\V1\SecurityMarks
Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
↳ event_time
Google\Protobuf\Timestamp
The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.
↳ create_time
↳ severity
int
The severity of the finding. This field is managed by the source that writes the finding.
↳ canonical_name
string
The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or "projects/{project_number}/sources/{source_id}/findings/{finding_id}", depending on the closest CRM ancestor of the resource associated with the finding.
↳ mute
int
Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
↳ finding_class
int
The class of the finding.
↳ indicator
Google\Cloud\SecurityCenter\V1\Indicator
Represents what's commonly known as an Indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
↳ vulnerability
Google\Cloud\SecurityCenter\V1\Vulnerability
Represents vulnerability-specific fields like CVE and CVS scores. CVE stands for Common Vulnerabilities and Exposures ( https://cve.mitre.org/about/ )
↳ mute_update_time
↳ external_systems
array| Google\Protobuf\Internal\MapField
Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.
↳ mitre_attack
Google\Cloud\SecurityCenter\V1\MitreAttack
MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org
↳ access
Google\Cloud\SecurityCenter\V1\Access
Access details associated to the Finding, such as more information on the caller, which method was accessed, from where, etc.
↳ connections
array< Google\Cloud\SecurityCenter\V1\Connection
>
Contains information about the IP connection associated with the finding.
↳ mute_initiator
string
First known as mute_annotation. Records additional information about the mute operation e.g. mute config that muted the finding, user who muted the finding, etc. Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
↳ processes
array< Google\Cloud\SecurityCenter\V1\Process
>
Represents operating system processes associated with the Finding.
↳ contacts
array| Google\Protobuf\Internal\MapField
Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories { "security": { "contacts": [ { "email": "person1@company.com" }, { "email": "person2@company.com" } ] } }
↳ compliances
array< Google\Cloud\SecurityCenter\V1\Compliance
>
Contains compliance information for security standards associated to the finding.
↳ parent_display_name
string
Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
↳ description
string
Contains more detail about the finding.
↳ exfiltration
↳ iam_bindings
array< Google\Cloud\SecurityCenter\V1\IamBinding
>
Represents IAM bindings associated with the Finding.
↳ next_steps
string
Next steps associate to the finding.
↳ containers
array< Google\Cloud\SecurityCenter\V1\Container
>
Containers associated with the finding. containers provides information for both Kubernetes and non-Kubernetes containers.
↳ kubernetes
↳ database
↳ files
↳ kernel_rootkit
getName
The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}"
string
setName
The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}"
var
string
$this
getParent
The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time.
For example: "organizations/{organization_id}/sources/{source_id}"
string
setParent
The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time.
For example: "organizations/{organization_id}/sources/{source_id}"
var
string
$this
getResourceName
For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time.
string
setResourceName
For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time.
var
string
$this
getState
The state of the finding.
int
setState
The state of the finding.
var
int
$this
getCategory
The additional taxonomy group within findings from a given source.
This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"
string
setCategory
The additional taxonomy group within findings from a given source.
This field is immutable after creation time. Example: "XSS_FLASH_INJECTION"
var
string
$this
getExternalUri
The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found.
This field is guaranteed to be either empty or a well formed URL.
string
setExternalUri
The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found.
This field is guaranteed to be either empty or a well formed URL.
var
string
$this
getSourceProperties
Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.
setSourceProperties
Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.
$this
getSecurityMarks
Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
hasSecurityMarks
clearSecurityMarks
setSecurityMarks
Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
$this
getEventTime
The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred.
For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.
hasEventTime
clearEventTime
setEventTime
The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred.
For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.
$this
getCreateTime
The time at which the finding was created in Security Command Center.
hasCreateTime
clearCreateTime
setCreateTime
The time at which the finding was created in Security Command Center.
$this
getSeverity
The severity of the finding. This field is managed by the source that writes the finding.
int
setSeverity
The severity of the finding. This field is managed by the source that writes the finding.
var
int
$this
getCanonicalName
The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or "projects/{project_number}/sources/{source_id}/findings/{finding_id}", depending on the closest CRM ancestor of the resource associated with the finding.
string
setCanonicalName
The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or "projects/{project_number}/sources/{source_id}/findings/{finding_id}", depending on the closest CRM ancestor of the resource associated with the finding.
var
string
$this
getMute
Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
int
setMute
Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
var
int
$this
getFindingClass
The class of the finding.
int
setFindingClass
The class of the finding.
var
int
$this
getIndicator
Represents what's commonly known as an Indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion.
Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
hasIndicator
clearIndicator
setIndicator
Represents what's commonly known as an Indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion.
Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
$this
getVulnerability
Represents vulnerability-specific fields like CVE and CVS scores.
CVE stands for Common Vulnerabilities and Exposures ( https://cve.mitre.org/about/ )
hasVulnerability
clearVulnerability
setVulnerability
Represents vulnerability-specific fields like CVE and CVS scores.
CVE stands for Common Vulnerabilities and Exposures ( https://cve.mitre.org/about/ )
$this
getMuteUpdateTime
Output only. The most recent time this finding was muted or unmuted.
hasMuteUpdateTime
clearMuteUpdateTime
setMuteUpdateTime
Output only. The most recent time this finding was muted or unmuted.
$this
getExternalSystems
Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.
setExternalSystems
Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.
$this
getMitreAttack
MITRE ATT&CK tactics and techniques related to this finding.
hasMitreAttack
clearMitreAttack
setMitreAttack
MITRE ATT&CK tactics and techniques related to this finding.
$this
getAccess
Access details associated to the Finding, such as more information on the caller, which method was accessed, from where, etc.
hasAccess
clearAccess
setAccess
Access details associated to the Finding, such as more information on the caller, which method was accessed, from where, etc.
$this
getConnections
Contains information about the IP connection associated with the finding.
setConnections
Contains information about the IP connection associated with the finding.
$this
getMuteInitiator
First known as mute_annotation. Records additional information about the mute operation e.g. mute config that muted the finding, user who muted the finding, etc. Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
string
setMuteInitiator
First known as mute_annotation. Records additional information about the mute operation e.g. mute config that muted the finding, user who muted the finding, etc. Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
var
string
$this
getProcesses
Represents operating system processes associated with the Finding.
setProcesses
Represents operating system processes associated with the Finding.
$this
getContacts
Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories { "security": { "contacts": [ { "email": "person1@company.com" }, { "email": "person2@company.com" } ] } }
setContacts
Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories { "security": { "contacts": [ { "email": "person1@company.com" }, { "email": "person2@company.com" } ] } }
$this
getCompliances
Contains compliance information for security standards associated to the finding.
setCompliances
Contains compliance information for security standards associated to the finding.
$this
getParentDisplayName
Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
string
setParentDisplayName
Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
var
string
$this
getDescription
Contains more detail about the finding.
string
setDescription
Contains more detail about the finding.
var
string
$this
getExfiltration
Represents exfiltration associated with the Finding.
hasExfiltration
clearExfiltration
setExfiltration
Represents exfiltration associated with the Finding.
$this
getIamBindings
Represents IAM bindings associated with the Finding.
setIamBindings
Represents IAM bindings associated with the Finding.
$this
getNextSteps
Next steps associate to the finding.
string
setNextSteps
Next steps associate to the finding.
var
string
$this
getContainers
Containers associated with the finding. containers provides information for both Kubernetes and non-Kubernetes containers.
setContainers
Containers associated with the finding. containers provides information for both Kubernetes and non-Kubernetes containers.
$this
getKubernetes
Kubernetes resources associated with the finding.
hasKubernetes
clearKubernetes
setKubernetes
Kubernetes resources associated with the finding.
$this
getDatabase
Database associated with the finding.
hasDatabase
clearDatabase
setDatabase
Database associated with the finding.
$this
getFiles
File associated with the finding.
setFiles
File associated with the finding.
$this
getKernelRootkit
Kernel Rootkit signature.
hasKernelRootkit
clearKernelRootkit
setKernelRootkit
Kernel Rootkit signature.
$this
