# frozen_string_literal: true

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Auto-generated by gapic-generator-ruby. DO NOT EDIT!


module Google
  module Cloud
    module SecurityCenter
      module V1
        # Security Command Center finding.
        #
        # A finding is a record of assessment data like security, risk, health, or
        # privacy, that is ingested into Security Command Center for presentation,
        # notification, analysis, policy testing, and enforcement. For example, a
        # cross-site scripting (XSS) vulnerability in an App Engine application is a
        # finding.
        # @!attribute [rw] name
        #   @return [::String]
        #     The [relative resource
        #     name](https://cloud.google.com/apis/design/resource_names#relative_resource_name)
        #     of the finding. Example:
        #     "organizations/\\{organization_id}/sources/\\{source_id}/findings/\\{finding_id}",
        #     "folders/\\{folder_id}/sources/\\{source_id}/findings/\\{finding_id}",
        #     "projects/\\{project_id}/sources/\\{source_id}/findings/\\{finding_id}".
        # @!attribute [rw] parent
        #   @return [::String]
        #     The relative resource name of the source the finding belongs to. See:
        #     https://cloud.google.com/apis/design/resource_names#relative_resource_name
        #     This field is immutable after creation time.
        #     For example:
        #     "organizations/\\{organization_id}/sources/\\{source_id}"
        # @!attribute [rw] resource_name
        #   @return [::String]
        #     For findings on Google Cloud resources, the full resource
        #     name of the Google Cloud resource this finding is for. See:
        #     https://cloud.google.com/apis/design/resource_names#full_resource_name
        #     When the finding is for a non-Google Cloud resource, the resourceName can
        #     be a customer or partner defined string. This field is immutable after
        #     creation time.
        # @!attribute [rw] state
        #   @return [::Google::Cloud::SecurityCenter::V1::Finding::State]
        #     The state of the finding.
        # @!attribute [rw] category
        #   @return [::String]
        #     The additional taxonomy group within findings from a given source.
        #     This field is immutable after creation time.
        #     Example: "XSS_FLASH_INJECTION"
        # @!attribute [rw] external_uri
        #   @return [::String]
        #     The URI that, if available, points to a web page outside of Security
        #     Command Center where additional information about the finding can be found.
        #     This field is guaranteed to be either empty or a well formed URL.
        # @!attribute [rw] source_properties
        #   @return [::Google::Protobuf::Map{::String => ::Google::Protobuf::Value}]
        #     Source specific properties. These properties are managed by the source
        #     that writes the finding. The key names in the source_properties map must be
        #     between 1 and 255 characters, and must start with a letter and contain
        #     alphanumeric characters or underscores only.
        # @!attribute [r] security_marks
        #   @return [::Google::Cloud::SecurityCenter::V1::SecurityMarks]
        #     Output only. User specified security marks. These marks are entirely
        #     managed by the user and come from the SecurityMarks resource that belongs
        #     to the finding.
        # @!attribute [rw] event_time
        #   @return [::Google::Protobuf::Timestamp]
        #     The time the finding was first detected. If an existing finding is updated,
        #     then this is the time the update occurred.
        #     For example, if the finding represents an open firewall, this property
        #     captures the time the detector believes the firewall became open. The
        #     accuracy is determined by the detector. If the finding is later resolved,
        #     then this time reflects when the finding was resolved. This must not
        #     be set to a value greater than the current timestamp.
        # @!attribute [rw] create_time
        #   @return [::Google::Protobuf::Timestamp]
        #     The time at which the finding was created in Security Command Center.
        # @!attribute [rw] severity
        #   @return [::Google::Cloud::SecurityCenter::V1::Finding::Severity]
        #     The severity of the finding. This field is managed by the source that
        #     writes the finding.
        # @!attribute [rw] canonical_name
        #   @return [::String]
        #     The canonical name of the finding. It's either
        #     "organizations/\\{organization_id}/sources/\\{source_id}/findings/\\{finding_id}",
        #     "folders/\\{folder_id}/sources/\\{source_id}/findings/\\{finding_id}" or
        #     "projects/\\{project_number}/sources/\\{source_id}/findings/\\{finding_id}",
        #     depending on the closest CRM ancestor of the resource associated with the
        #     finding.
        # @!attribute [rw] mute
        #   @return [::Google::Cloud::SecurityCenter::V1::Finding::Mute]
        #     Indicates the mute state of a finding (either muted, unmuted
        #     or undefined). Unlike other attributes of a finding, a finding provider
        #     shouldn't set the value of mute.
        # @!attribute [rw] finding_class
        #   @return [::Google::Cloud::SecurityCenter::V1::Finding::FindingClass]
        #     The class of the finding.
        # @!attribute [rw] indicator
        #   @return [::Google::Cloud::SecurityCenter::V1::Indicator]
        #     Represents what's commonly known as an *indicator of compromise* (IoC) in
        #     computer forensics. This is an artifact observed on a network or in an
        #     operating system that, with high confidence, indicates a computer
        #     intrusion. For more information, see [Indicator of
        #     compromise](https://en.wikipedia.org/wiki/Indicator_of_compromise).
        # @!attribute [rw] vulnerability
        #   @return [::Google::Cloud::SecurityCenter::V1::Vulnerability]
        #     Represents vulnerability-specific fields like CVE and CVSS scores.
        #     CVE stands for Common Vulnerabilities and Exposures
        #     (https://cve.mitre.org/about/)
        # @!attribute [r] mute_update_time
        #   @return [::Google::Protobuf::Timestamp]
        #     Output only. The most recent time this finding was muted or unmuted.
        # @!attribute [r] external_systems
        #   @return [::Google::Protobuf::Map{::String => ::Google::Cloud::SecurityCenter::V1::ExternalSystem}]
        #     Output only. Third party SIEM/SOAR fields within SCC, contains external
        #     system information and external system finding fields.
        # @!attribute [rw] mitre_attack
        #   @return [::Google::Cloud::SecurityCenter::V1::MitreAttack]
        #     MITRE ATT&CK tactics and techniques related to this finding.
        #     See: https://attack.mitre.org
        # @!attribute [rw] access
        #   @return [::Google::Cloud::SecurityCenter::V1::Access]
        #     Access details associated with the finding, such as more information on the
        #     caller, which method was accessed, and from where.
        # @!attribute [rw] connections
        #   @return [::Array<::Google::Cloud::SecurityCenter::V1::Connection>]
        #     Contains information about the IP connection associated with the finding.
        # @!attribute [rw] mute_initiator
        #   @return [::String]
        #     Records additional information about the mute operation, for example, the
        #     [mute configuration](/security-command-center/docs/how-to-mute-findings)
        #     that muted the finding and the user who muted the finding.
        # @!attribute [r] mute_info
        #   @return [::Google::Cloud::SecurityCenter::V1::Finding::MuteInfo]
        #     Output only. The mute information regarding this finding.
        # @!attribute [rw] processes
        #   @return [::Array<::Google::Cloud::SecurityCenter::V1::Process>]
        #     Represents operating system processes associated with the Finding.
        # @!attribute [r] contacts
        #   @return [::Google::Protobuf::Map{::String => ::Google::Cloud::SecurityCenter::V1::ContactDetails}]
        #     Output only. Map containing the points of contact for the given finding.
        #     The key represents the type of contact, while the value contains a list of
        #     all the contacts that pertain. Please refer to:
        #     https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories
        #
        #         {
        #           "security": {
        #             "contacts": [
        #               {
        #                 "email": "person1@company.com"
        #               },
        #               {
        #                 "email": "person2@company.com"
        #               }
        #             ]
        #           }
        #         }
        # @!attribute [rw] compliances
        #   @return [::Array<::Google::Cloud::SecurityCenter::V1::Compliance>]
        #     Contains compliance information for security standards associated to the
        #     finding.
        # @!attribute [r] parent_display_name
        #   @return [::String]
        #     Output only. The human readable display name of the finding source such as
        #     "Event Threat Detection" or "Security Health Analytics".
        # @!attribute [rw] description
        #   @return [::String]
        #     Contains more details about the finding.
        # @!attribute [rw] exfiltration
        #   @return [::Google::Cloud::SecurityCenter::V1::Exfiltration]
        #     Represents exfiltrations associated with the finding.
        # @!attribute [rw] iam_bindings
        #   @return [::Array<::Google::Cloud::SecurityCenter::V1::IamBinding>]
        #     Represents IAM bindings associated with the finding.
        # @!attribute [rw] next_steps
        #   @return [::String]
        #     Steps to address the finding.
        # @!attribute [rw] module_name
        #   @return [::String]
        #     Unique identifier of the module which generated the finding.
        #     Example:
        #     folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885
        # @!attribute [rw] containers
        #   @return [::Array<::Google::Cloud::SecurityCenter::V1::Container>]
        #     Containers associated with the finding. This field provides information for
        #     both Kubernetes and non-Kubernetes containers.
        # @!attribute [rw] kubernetes
        #   @return [::Google::Cloud::SecurityCenter::V1::Kubernetes]
        #     Kubernetes resources associated with the finding.
        # @!attribute [rw] database
        #   @return [::Google::Cloud::SecurityCenter::V1::Database]
        #     Database associated with the finding.
        # @!attribute [rw] attack_exposure
        #   @return [::Google::Cloud::SecurityCenter::V1::AttackExposure]
        #     The results of an attack path simulation relevant to this finding.
        # @!attribute [rw] files
        #   @return [::Array<::Google::Cloud::SecurityCenter::V1::File>]
        #     File associated with the finding.
        # @!attribute [rw] cloud_dlp_inspection
        #   @return [::Google::Cloud::SecurityCenter::V1::CloudDlpInspection]
        #     Cloud Data Loss Prevention (Cloud DLP) inspection results that are
        #     associated with the finding.
        # @!attribute [rw] cloud_dlp_data_profile
        #   @return [::Google::Cloud::SecurityCenter::V1::CloudDlpDataProfile]
        #     Cloud DLP data profile that is associated with the finding.
        # @!attribute [rw] kernel_rootkit
        #   @return [::Google::Cloud::SecurityCenter::V1::KernelRootkit]
        #     Signature of the kernel rootkit.
        # @!attribute [rw] org_policies
        #   @return [::Array<::Google::Cloud::SecurityCenter::V1::OrgPolicy>]
        #     Contains information about the org policies associated with the finding.
        # @!attribute [rw] application
        #   @return [::Google::Cloud::SecurityCenter::V1::Application]
        #     Represents an application associated with the finding.
        # @!attribute [rw] backup_disaster_recovery
        #   @return [::Google::Cloud::SecurityCenter::V1::BackupDisasterRecovery]
        #     Fields related to Backup and DR findings.
        # @!attribute [rw] security_posture
        #   @return [::Google::Cloud::SecurityCenter::V1::SecurityPosture]
        #     The security posture associated with the finding.
        # @!attribute [rw] log_entries
        #   @return [::Array<::Google::Cloud::SecurityCenter::V1::LogEntry>]
        #     Log entries that are relevant to the finding.
        # @!attribute [rw] load_balancers
        #   @return [::Array<::Google::Cloud::SecurityCenter::V1::LoadBalancer>]
        #     The load balancers associated with the finding.
        # @!attribute [rw] cloud_armor
        #   @return [::Google::Cloud::SecurityCenter::V1::CloudArmor]
        #     Fields related to Cloud Armor findings.
        # @!attribute [rw] notebook
        #   @return [::Google::Cloud::SecurityCenter::V1::Notebook]
        #     Notebook associated with the finding.
        # @!attribute [rw] toxic_combination
        #   @return [::Google::Cloud::SecurityCenter::V1::ToxicCombination]
        #     Contains details about a group of security issues that, when the issues
        #     occur together, represent a greater risk than when the issues occur
        #     independently. A group of such issues is referred to as a toxic
        #     combination.
        #     This field cannot be updated. Its value is ignored in all update requests.
        # @!attribute [rw] group_memberships
        #   @return [::Array<::Google::Cloud::SecurityCenter::V1::GroupMembership>]
        #     Contains details about groups of which this finding is a member. A group is
        #     a collection of findings that are related in some way.
        #     This field cannot be updated. Its value is ignored in all update requests.
        class Finding
          include ::Google::Protobuf::MessageExts
          extend ::Google::Protobuf::MessageExts::ClassMethods

          # Mute information about the finding, including whether the finding has a
          # static mute or any matching dynamic mute rules.
          # @!attribute [rw] static_mute
          #   @return [::Google::Cloud::SecurityCenter::V1::Finding::MuteInfo::StaticMute]
          #     If set, the static mute applied to this finding. Static mutes override
          #     dynamic mutes. If unset, there is no static mute.
          # @!attribute [rw] dynamic_mute_records
          #   @return [::Array<::Google::Cloud::SecurityCenter::V1::Finding::MuteInfo::DynamicMuteRecord>]
          #     The list of dynamic mute rules that currently match the finding.
          class MuteInfo
            include ::Google::Protobuf::MessageExts
            extend ::Google::Protobuf::MessageExts::ClassMethods

            # Information about the static mute state. A static mute state overrides
            # any dynamic mute rules that apply to this finding. The static mute state
            # can be set by a static mute rule or by muting the finding directly.
            # @!attribute [rw] state
            #   @return [::Google::Cloud::SecurityCenter::V1::Finding::Mute]
            #     The static mute state. If the value is `MUTED` or `UNMUTED`, then the
            #     finding's overall mute state will have the same value.
            # @!attribute [rw] apply_time
            #   @return [::Google::Protobuf::Timestamp]
            #     When the static mute was applied.
            class StaticMute
              include ::Google::Protobuf::MessageExts
              extend ::Google::Protobuf::MessageExts::ClassMethods
            end

            # The record of a dynamic mute rule that matches the finding.
            # @!attribute [rw] mute_config
            #   @return [::String]
            #     The relative resource name of the mute rule, represented by a mute
            #     config, that created this record, for example
            #     `organizations/123/muteConfigs/mymuteconfig` or
            #     `organizations/123/locations/global/muteConfigs/mymuteconfig`.
            # @!attribute [rw] match_time
            #   @return [::Google::Protobuf::Timestamp]
            #     When the dynamic mute rule first matched the finding.
            class DynamicMuteRecord
              include ::Google::Protobuf::MessageExts
              extend ::Google::Protobuf::MessageExts::ClassMethods
            end
          end

          # @!attribute [rw] key
          #   @return [::String]
          # @!attribute [rw] value
          #   @return [::Google::Protobuf::Value]
          class SourcePropertiesEntry
            include ::Google::Protobuf::MessageExts
            extend ::Google::Protobuf::MessageExts::ClassMethods
          end

          # @!attribute [rw] key
          #   @return [::String]
          # @!attribute [rw] value
          #   @return [::Google::Cloud::SecurityCenter::V1::ExternalSystem]
          class ExternalSystemsEntry
            include ::Google::Protobuf::MessageExts
            extend ::Google::Protobuf::MessageExts::ClassMethods
          end

          # @!attribute [rw] key
          #   @return [::String]
          # @!attribute [rw] value
          #   @return [::Google::Cloud::SecurityCenter::V1::ContactDetails]
          class ContactsEntry
            include ::Google::Protobuf::MessageExts
            extend ::Google::Protobuf::MessageExts::ClassMethods
          end

          # The state of the finding.
          module State
            # Unspecified state.
            STATE_UNSPECIFIED = 0

            # The finding requires attention and has not been addressed yet.
            ACTIVE = 1

            # The finding has been fixed, triaged as a non-issue or otherwise addressed
            # and is no longer active.
            INACTIVE = 2
          end

          # The severity of the finding.
          module Severity
            # This value is used for findings when a source doesn't write a severity
            # value.
            SEVERITY_UNSPECIFIED = 0

            # Vulnerability:
            # A critical vulnerability is easily discoverable by an external actor,
            # exploitable, and results in the direct ability to execute arbitrary code,
            # exfiltrate data, and otherwise gain additional access and privileges to
            # cloud resources and workloads. Examples include publicly accessible
            # unprotected user data and public SSH access with weak or no
            # passwords.
            #
            # Threat:
            # Indicates a threat that is able to access, modify, or delete data or
            # execute unauthorized code within existing resources.
            CRITICAL = 1

            # Vulnerability:
            # A high risk vulnerability can be easily discovered and exploited in
            # combination with other vulnerabilities in order to gain direct access and
            # the ability to execute arbitrary code, exfiltrate data, and otherwise
            # gain additional access and privileges to cloud resources and workloads.
            # An example is a database with weak or no passwords that is only
            # accessible internally. This database could easily be compromised by an
            # actor that had access to the internal network.
            #
            # Threat:
            # Indicates a threat that is able to create new computational resources in
            # an environment but not able to access data or execute code in existing
            # resources.
            HIGH = 2

            # Vulnerability:
            # A medium risk vulnerability could be used by an actor to gain access to
            # resources or privileges that enable them to eventually (through multiple
            # steps or a complex exploit) gain access and the ability to execute
            # arbitrary code or exfiltrate data. An example is a service account with
            # access to more projects than it should have. If an actor gains access to
            # the service account, they could potentially use that access to manipulate
            # a project the service account was not intended to.
            #
            # Threat:
            # Indicates a threat that is able to cause operational impact but may not
            # access data or execute unauthorized code.
            MEDIUM = 3

            # Vulnerability:
            # A low risk vulnerability hampers a security organization's ability to
            # detect vulnerabilities or active threats in their deployment, or prevents
            # the root cause investigation of security issues. An example is monitoring
            # and logs being disabled for resource configurations and access.
            #
            # Threat:
            # Indicates a threat that has obtained minimal access to an environment but
            # is not able to access data, execute code, or create resources.
            LOW = 4
          end

          # Mute state a finding can be in.
          module Mute
            # Unspecified.
            MUTE_UNSPECIFIED = 0

            # Finding has been muted.
            MUTED = 1

            # Finding has been unmuted.
            UNMUTED = 2

            # Finding has never been muted/unmuted.
            UNDEFINED = 4
          end

          # Represents what kind of Finding it is.
          module FindingClass
            # Unspecified finding class.
            FINDING_CLASS_UNSPECIFIED = 0

            # Describes unwanted or malicious activity.
            THREAT = 1

            # Describes a potential weakness in software that increases risk to
            # Confidentiality & Integrity & Availability.
            VULNERABILITY = 2

            # Describes a potential weakness in cloud resource/asset configuration that
            # increases risk.
            MISCONFIGURATION = 3

            # Describes a security observation that is for informational purposes.
            OBSERVATION = 4

            # Describes an error that prevents some SCC functionality.
            SCC_ERROR = 5

            # Describes a potential security risk due to a change in the security
            # posture.
            POSTURE_VIOLATION = 6

            # Describes a group of security issues that, when the issues
            # occur together, represent a greater risk than when the issues occur
            # independently. A group of such issues is referred to as a toxic
            # combination.
            TOXIC_COMBINATION = 7
          end
        end
      end
    end
  end
end
