REST Resource: organizations.locations.securityProfiles

Resource: SecurityProfile

SecurityProfile is a resource that defines the behavior for one of many ProfileType values.

JSON representation 
{
  "name": string,
  "description": string,
  "createTime": string,
  "updateTime": string,
  "etag": string,
  "labels": {
    string: string,
    ...
  },
  "type": enum (ProfileType),

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "threatPreventionProfile": {
    object (ThreatPreventionProfile)
  },
  "customMirroringProfile": {
    object (CustomMirroringProfile)
  },
  "customInterceptProfile": {
    object (CustomInterceptProfile)
  },
  "urlFilteringProfile": {
    object (UrlFilteringProfile)
  },
  "wildfireAnalysisProfile": {
    object (WildfireAnalysisProfile)
  }
  // End of mutually exclusive fields.
}
Fields
name

string

Immutable. Identifier. Name of the SecurityProfile resource. It matches the pattern projects|organizations/*/locations/{location}/securityProfiles/{securityProfile}.
description

string

Optional. An optional description of the profile. The maximum length is 512 characters.
createTime

string (Timestamp format)

Output only. Resource creation timestamp.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime

string (Timestamp format)

Output only. Last resource update timestamp.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
etag

string

Output only. This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.
labels

map (key: string, value: string)

Optional. Labels as key-value pairs.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
type

enum (ProfileType)

Immutable. The single ProfileType that the SecurityProfile resource configures.
The behavior for the ProfileType that the SecurityProfile resource configures. This field must correspond to the ProfileType of the SecurityProfile. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
threatPreventionProfile

object (ThreatPreventionProfile)

The threat prevention configuration for the SecurityProfile.
customMirroringProfile

object (CustomMirroringProfile)

The custom Packet Mirroring v2 configuration for the SecurityProfile.
customInterceptProfile

object (CustomInterceptProfile)

The custom TPPI configuration for the SecurityProfile.
urlFilteringProfile

object (UrlFilteringProfile)

The URL filtering configuration for the SecurityProfile.
wildfireAnalysisProfile

object (WildfireAnalysisProfile)

The Advanced malware sandbox analysis configuration for the SecurityProfile.
End of mutually exclusive fields.

ThreatPreventionProfile

ThreatPreventionProfile defines an action for specific threat signatures or severity levels.

JSON representation 
{
  "severityOverrides": [
    {
      object (SeverityOverride)
    }
  ],
  "threatOverrides": [
    {
      object (ThreatOverride)
    }
  ],
  "antivirusOverrides": [
    {
      object (AntivirusOverride)
    }
  ]
}
Fields
severityOverrides[]

object (SeverityOverride)

Optional. Configuration for overriding threats actions by severity match.
threatOverrides[]

object (ThreatOverride)

Optional. Configuration for overriding threats actions by threatId match. If a threat is matched both by configuration provided in severityOverrides and threatOverrides, the threatOverrides action is applied.
antivirusOverrides[]

object (AntivirusOverride)

Optional. Configuration for overriding antivirus actions per protocol.

SeverityOverride

Defines what action to take for a specific severity match.

JSON representation 
{
  "severity": enum (Severity),
  "action": enum (ThreatAction)
}
Fields
severity

enum (Severity)

Required. Severity level to match.
action

enum (ThreatAction)

Required. Threat action override.

Severity

Severity level.

Enums
SEVERITY_UNSPECIFIED Severity level not specified.
INFORMATIONAL Suspicious events that do not pose an immediate threat, but that are reported to call attention to deeper problems that could possibly exist.
LOW Warning-level threats that have very little impact on an organization's infrastructure. They usually require local or physical system access and may often result in victim privacy issues and information leakage.
MEDIUM Minor threats in which impact is minimized, that do not compromise the target or exploits that require an attacker to reside on the same local network as the victim, affect only non-standard configurations or obscure applications, or provide very limited access.
HIGH Threats that have the ability to become critical but have mitigating factors; for example, they may be difficult to exploit, do not result in elevated privileges, or do not have a large victim pool.
CRITICAL Serious threats, such as those that affect default installations of widely deployed software, result in root compromise of servers, and the exploit code is widely available to attackers. The attacker usually does not need any special authentication credentials or knowledge about the individual victims and the target does not need to be manipulated into performing any special functions.

ThreatAction

Threat action override.

Enums
THREAT_ACTION_UNSPECIFIED Threat action not specified.
DEFAULT_ACTION The default action (as specified by the vendor) is taken.
ALLOW The packet matching this rule will be allowed to transmit.
ALERT The packet matching this rule will be allowed to transmit, but a threat_log entry will be sent to the consumer project.
DENY The packet matching this rule will be dropped, and a threat_log entry will be sent to the consumer project.

ThreatOverride

Defines what action to take for a specific threatId match.

JSON representation 
{
  "threatId": string,
  "type": enum (ThreatType),
  "action": enum (ThreatAction)
}
Fields
threatId

string

Required. Vendor-specific ID of a threat to override.
type

enum (ThreatType)

Output only. Type of the threat (read only).
action

enum (ThreatAction)

Required. Threat action override. For some threat types, only a subset of actions applies.

ThreatType

Type of threat.

Enums
THREAT_TYPE_UNSPECIFIED Type of threat not specified.
UNKNOWN Type of threat is not derivable from threat ID. An override will be created for all types. Firewall will ignore overridden signature ID's that don't exist in the specific type.
VULNERABILITY Threats related to system flaws that an attacker might otherwise attempt to exploit.
ANTIVIRUS Threats related to viruses and malware found in executables and file types.
SPYWARE Threats related to command-and-control (C2) activity, where spyware on an infected client is collecting data without the user's consent and/or communicating with a remote attacker.
DNS Threats related to DNS.

AntivirusOverride

Defines what action to take for antivirus threats per protocol.

JSON representation 
{
  "protocol": enum (Protocol),
  "action": enum (ThreatAction)
}
Fields
protocol

enum (Protocol)

Required. Protocol to match.
action

enum (ThreatAction)

Required. Threat action override. For some threat types, only a subset of actions applies.

Protocol

Antivirus protocol.

Enums
PROTOCOL_UNSPECIFIED Protocol not specified.
SMTP SMTP protocol
SMB SMB protocol
POP3 POP3 protocol
IMAP IMAP protocol
HTTP2 HTTP2 protocol
HTTP HTTP protocol
FTP FTP protocol

CustomMirroringProfile

CustomMirroringProfile defines out-of-band integration behavior (mirroring). It is used by mirroring rules with a MIRROR action.

JSON representation 
{
  "mirroringEndpointGroup": string,
  "mirroringDeploymentGroups": [
    string
  ],
  "mirroringEndpointGroupType": enum (MirroringEndpointGroupType)
}
Fields
mirroringEndpointGroup

string

Required. Immutable. The target MirroringEndpointGroup. When a mirroring rule with this security profile attached matches a packet, a replica will be mirrored to the location-local target in this group.
mirroringDeploymentGroups[]

string

Optional. The target downstream MirroringDeploymentGroups. This field is used for Packet Broker mirroring endpoint groups to specify the deployment groups that the packet should be mirrored to by the broker.
mirroringEndpointGroupType

enum (MirroringEndpointGroupType)

Output only.

MirroringEndpointGroupType

The type of the mirroring endpoint group this Profile is attached to.

Enums
MIRRORING_ENDPOINT_GROUP_TYPE_UNSPECIFIED Default value. This value is unused.
DIRECT The endpoint group is a direct endpoint group.
BROKER The endpoint group is a broker endpoint group.

CustomInterceptProfile

CustomInterceptProfile defines in-band integration behavior (intercept). It is used by firewall rules with an APPLY_SECURITY_PROFILE_GROUP action.

JSON representation 
{
  "interceptEndpointGroup": string
}
Fields
interceptEndpointGroup

string

Required. The target InterceptEndpointGroup. When a firewall rule with this security profile attached matches a packet, the packet will be intercepted to the location-local target in this group.

UrlFilteringProfile

UrlFilteringProfile defines filters based on URL.

JSON representation 
{
  "urlFilters": [
    {
      object (UrlFilter)
    }
  ]
}
Fields
urlFilters[]

object (UrlFilter)

Optional. The list of filtering configs in which each config defines an action to take for some URL match.

UrlFilter

A URL filter defines an action to take for some URL match.

JSON representation 
{
  "filteringAction": enum (UrlFilteringAction),
  "urls": [
    string
  ],
  "priority": integer
}
Fields
filteringAction

enum (UrlFilteringAction)

Required. The action taken when this filter is applied.
urls[]

string

Required. The list of strings that a URL must match with for this filter to be applied.
priority

integer

Required. The priority of this filter within the URL Filtering Profile. Lower integers indicate higher priorities. The priority of a filter must be unique within a URL Filtering Profile.

UrlFilteringAction

Action to be taken when a URL matches a filter.

Enums
URL_FILTERING_ACTION_UNSPECIFIED Filtering action not specified.
ALLOW The connection matching this filter will be allowed to transmit.
DENY The connection matching this filter will be dropped.

WildfireAnalysisProfile

WildfireAnalysisProfile defines Palo Alto Networks WildFire behavior.

JSON representation 
{
  "wildfireSubmissionRules": [
    {
      object (WildfireSubmissionRule)
    }
  ],
  "wildfireInlineCloudAnalysisRules": [
    {
      object (WildfireInlineCloudAnalysisRule)
    }
  ],
  "wildfireOverrides": [
    {
      object (WildfireOverride)
    }
  ],
  "wildfireInlineMlOverrides": [
    {
      object (WildfireInlineMlOverride)
    }
  ],
  "wildfireRealtimeLookup": boolean,
  "wildfireInlineMlSettings": [
    {
      object (WildfireInlineMlSettings)
    }
  ],
  "wildfireThreatOverrides": [
    {
      object (WildfireThreatOverride)
    }
  ],
  "wildfireInlineMlSetting": {
    object (WildfireInlineMlSettings)
  }
}
Fields
wildfireSubmissionRules[]

object (WildfireSubmissionRule)

Optional. Configurations for Advanced malware sandbox (WildFire) file submissions.
wildfireInlineCloudAnalysisRules[]

object (WildfireInlineCloudAnalysisRule)

Optional. Configuration for Advanced malware sandbox inline cloud analysis.
wildfireOverrides[]

object (WildfireOverride)

Optional. Configuration for overriding Advanced malware sandbox actions per protocol.
wildfireInlineMlOverrides[]

object (WildfireInlineMlOverride)

Optional. Configuration for overriding inline ML Advanced malware sandbox actions per protocol.
wildfireRealtimeLookup

boolean

Optional. Whether to hold the transfer of a file while the Advanced malware sandbox real-time signature cloud performs a signature lookup. The default value is false.
wildfireInlineMlSettings[]
(deprecated)

object (WildfireInlineMlSettings)

Optional. Settings for Advanced malware sandbox inline ML analysis.
wildfireThreatOverrides[]

object (WildfireThreatOverride)

Optional. Configuration for overriding the Advanced malware sandbox threat action by threatId match.
wildfireInlineMlSetting

object (WildfireInlineMlSettings)

Optional. Settings for Advanced malware sandbox inline ML analysis.

WildfireSubmissionRule

Defines the file types to be submitted for Advanced malware sandbox analysis and the direction of the traffic.

JSON representation 
{
  "fileSelectionMode": enum (FileSelectionMode),
  "direction": enum (Direction),

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "customFileTypes": {
    object (CustomFileTypes)
  }
  // End of mutually exclusive fields.
}
Fields
fileSelectionMode

enum (FileSelectionMode)

Required. File selection mode for Advanced malware sandbox analysis.
direction

enum (Direction)

Required. Direction for the files to be analyzed by Advanced malware sandbox.
The behavior for the FileSelectionMode that the WildfireSubmissionRule configuration configures. This field must correspond to the FileSelectionMode of the WildfireSubmissionRule. If the FileSelectionMode is ALL_FILE_TYPES, omit this field. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
customFileTypes

object (CustomFileTypes)

Submit a custom list of file types for Advanced malware sandbox analysis.
End of mutually exclusive fields.

CustomFileTypes

The options to submit a custom list of file types for scanning.

JSON representation 
{
  "fileTypes": [
    enum (FileType)
  ]
}
Fields
fileTypes[]

enum (FileType)

Required. File types to be submitted for Advanced malware sandbox analysis.

FileType

File types supported by Advanced malware sandbox analysis.

Enums
FILE_TYPE_UNSPECIFIED File type not specified.
APK Android Application Package (APK) files.
ARCHIVE Roshal Archive (RAR) and 7-Zip (7z) archive files.
FLASH Adobe Flash applets and Flash content embedded in web pages.
JAR Java applets (JAR and class file types).
LINUX Executable and Linkable Format (ELF) files.
MS_OFFICE Files used by Microsoft Office.
PDF Portable Document Format (PDF) files.
PE Portable Executable (PE) files.
SCRIPT Script files, such as JScript (JS), VBScript (VBS), PowerShell scripts (PS1), batch files (BAT), and HTML Application (HTA) files.

FileSelectionMode

FileSelectionMode defines the options to submit a list of file types for Advanced malware sandbox analysis. Supports all file types or a custom list of file types.

Enums
FILE_SELECTION_MODE_UNSPECIFIED File selection mode not specified.
ALL_FILE_TYPES Submit all file types for scanning.
CUSTOM_FILE_TYPES Submit a custom list of file types for scanning.

Direction

The direction of Advanced malware sandbox traffic.

Enums
DIRECTION_UNSPECIFIED Direction not specified.
UPLOAD Upload direction.
DOWNLOAD Download direction.
BOTH Both upload and download directions.

WildfireInlineCloudAnalysisRule

The list of file type configurations to be scanned by Advanced malware sandbox inline cloud analysis.

JSON representation 
{
  "fileSelectionMode": enum (FileSelectionMode),
  "direction": enum (Direction),
  "action": enum (WildfireInlineCloudAnalysisAction),

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "customFileTypes": {
    object (CustomFileTypes)
  }
  // End of mutually exclusive fields.
}
Fields
fileSelectionMode

enum (FileSelectionMode)

Required. File selection mode for Advanced malware sandbox inline cloud analysis.
direction

enum (Direction)

Required. Direction for the files to be analyzed by Advanced malware sandbox inline cloud analysis.
action

enum (WildfireInlineCloudAnalysisAction)

Required. Action to take when a threat is detected using Advanced malware sandbox inline cloud analysis. The default value is DENY.
The behavior for the FileSelectionMode that the WildfireInlineCloudAnalysisRule configuration configures. This field must correspond to the FileSelectionMode of the WildfireInlineCloudAnalysisRule. If the FileSelectionMode is ALL_FILE_TYPES, omit this field. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
customFileTypes

object (CustomFileTypes)

Submit a custom list of file types for Advanced malware sandbox inline cloud analysis.
End of mutually exclusive fields.

CustomFileTypes

The options to submit a custom list of file types for scanning.

JSON representation 
{
  "fileTypes": [
    enum (FileType)
  ]
}
Fields
fileTypes[]

enum (FileType)

Required. File types to be submitted for Advanced malware sandbox inline cloud analysis.

FileType

File types supported by Advanced malware sandbox analysis.

Enums
FILE_TYPE_UNSPECIFIED File type not specified.
PE Portable Executable (PE) files.

FileSelectionMode

FileSelectionMode defines the options to submit a list of file types for Advanced malware sandbox inline cloud analysis. Supports all file types or a custom list of file types. By default, no file types are sent for scanning.

Enums
FILE_SELECTION_MODE_UNSPECIFIED File selection mode not specified.
ALL_FILE_TYPES Submit all file types for scanning.
CUSTOM_FILE_TYPES Submit a custom list of file types for scanning.

WildfireInlineCloudAnalysisAction

Available actions to take when a threat is detected using Advanced malware sandbox inline cloud analysis.

Enums
WILDFIRE_INLINE_CLOUD_ANALYSIS_ACTION_UNSPECIFIED Advanced malware sandbox inline cloud analysis action not specified.
ALLOW Files detected by Advanced malware sandbox inline cloud analysis are allowed to transmit.
DENY Files detected by Advanced malware sandbox inline cloud analysis are not allowed to transmit.
ALERT Files detected by Advanced malware sandbox inline cloud analysis are allowed to transmit, and a wildfire_submission_log entry is sent to the consumer project.

WildfireOverride

Defines what action to take for Advanced malware sandbox threats per protocol.

JSON representation 
{
  "protocol": enum (WildfireProtocol),
  "action": enum (WildfireThreatAction)
}
Fields
protocol

enum (WildfireProtocol)

Required. Protocol to match.
action

enum (WildfireThreatAction)

Required. Threat action override. For some threat types, only a subset of actions applies.

WildfireProtocol

Advanced malware sandbox protocol.

Enums
WILDFIRE_PROTOCOL_UNSPECIFIED Protocol not specified.
WILDFIRE_SMTP SMTP protocol.
WILDFIRE_SMB SMB protocol.
WILDFIRE_POP3 POP3 protocol.
WILDFIRE_IMAP IMAP protocol.
WILDFIRE_HTTP2 HTTP2 protocol.
WILDFIRE_HTTP HTTP protocol.
WILDFIRE_FTP FTP protocol.

WildfireThreatAction

Threat action override for Advanced malware sandbox.

Enums
WILDFIRE_THREAT_ACTION_UNSPECIFIED Threat action not specified.
WILDFIRE_DEFAULT_ACTION The default action (as specified by the vendor) is taken.
WILDFIRE_ALLOW Packets matching this rule are allowed to transmit.
WILDFIRE_ALERT Packets matching this rule are allowed to transmit, and a threat_log entry is sent to the consumer project.
WILDFIRE_DENY Packets matching this rule are dropped, and a threat_log entry is sent to the consumer project.

WildfireInlineMlOverride

Defines what action to take for Advanced malware sandbox inline ML threats per protocol.

JSON representation 
{
  "protocol": enum (WildfireProtocol),
  "action": enum (WildfireThreatAction)
}
Fields
protocol

enum (WildfireProtocol)

Required. Protocol to match for Advanced malware sandbox inline ML override.
action

enum (WildfireThreatAction)

Required. The action to take for Advanced malware sandbox inline ML override.

WildfireInlineMlSettings

Defines the settings for Advanced malware sandbox inline ML analysis.

JSON representation 
{
  "inlineMlConfigs": [
    {
      object (InlineMlConfig)
    }
  ],
  "fileExceptions": [
    {
      object (WildfireInlineMlFileException)
    }
  ]
}
Fields
inlineMlConfigs[]

object (InlineMlConfig)

Optional. List of inline ML configurations to enable in Advanced malware sandbox inline ML analysis.
fileExceptions[]

object (WildfireInlineMlFileException)

Optional. List of files to exclude from Advanced malware sandbox inline ML analysis.

InlineMlConfig

Configuration for Advanced malware sandbox inline ML analysis per file type.

JSON representation 
{
  "fileType": enum (InlineMlFileType),
  "action": enum (InlineMlAction)
}
Fields
fileType

enum (InlineMlFileType)

Required. File type to configure inline ML for.
action

enum (InlineMlAction)

Required. Action to take when a threat is detected using inline ML.

InlineMlFileType

Available inline ML file types.

Enums
INLINE_ML_CONFIG_UNSPECIFIED Inline ML configuration not specified.
WINDOWS_EXECUTABLE Enables the machine learning engine to dynamically detect malicious PE files.
POWERSHELL_SCRIPT1 Enables the machine learning engine to dynamically identify malicious PowerShell scripts with a known length.
POWERSHELL_SCRIPT2 Enables the machine learning engine to dynamically identify malicious PowerShell scripts without a known length.
ELF Enables the machine learning engine to dynamically detect malicious ELF files.
MS_OFFICE Enables the machine learning engine to dynamically detect malicious Microsoft Office (97-2003) files.
SHELL Enables the machine learning engine to dynamically detect malicious shell files.
OOXML Enables the machine learning engine to dynamically detect malicious Office Open XML (OOXML) files.
MACHO Enables the machine learning engine to dynamically detect malicious Mach-O files.

InlineMlAction

Advanced malware sandbox inline ML action override.

Enums
INLINE_ML_ACTION_UNSPECIFIED Inline ML threat action not specified.
DISABLE Disables Advanced malware sandbox inline ML for the associated file type.
ALERT Enables Advanced malware sandbox inline ML for the associated file type. Overrides any protocol-level settings with an action stricter than ALERT to ALERT so that detected malicious files generate a threat log in the consumer project without being blocked.
ENABLE Enables Advanced malware sandbox inline ML for the associated file type. Detected malicious files are blocked.

WildfireInlineMlFileException

Defines the file to exclude from Advanced malware sandbox inline ML analysis.

JSON representation 
{
  "partialHash": string,
  "filename": string
}
Fields
partialHash

string

Required. Machine learning partial hash of the file to exclude from Advanced malware sandbox inline ML analysis.
filename

string

Optional. Name of the file to exclude from Advanced malware sandbox inline ML analysis.

WildfireThreatOverride

Defines what action to take for a specific Advanced malware sandbox threatId match.

JSON representation 
{
  "threatId": string,
  "action": enum (WildfireThreatAction)
}
Fields
threatId

string

Required. Threat ID to match.
action

enum (WildfireThreatAction)

Required. Threat action override.

ProfileType

The possible types that the SecurityProfile resource can configure.

Enums
PROFILE_TYPE_UNSPECIFIED Profile type not specified.
THREAT_PREVENTION Profile type for threat prevention.
CUSTOM_MIRRORING Profile type for Packet Mirroring v2.
CUSTOM_INTERCEPT Profile type for TPPI.
URL_FILTERING Profile type for URL filtering.
WILDFIRE_ANALYSIS Profile type for Advanced malware sandbox (WildFire) analysis.

Methods

create

 Creates a new security profile in a given organization and location.

delete

 Deletes a single security profile.

get

 Gets details of a single security profile.

list

 Lists security profile resources in a given organization and location.

patch

 Updates the parameters of a single security profile.