MCP Tools Reference: securitycenter.googleapis.com

Tool: list_findings

Lists, searches, or retrieves security findings across organizations, folders, or projects in Security Command Center.

Filtering (AIP-160 Syntax): The filter argument follows Google API AIP-160 syntax (string values MUST be in double quotes): * By state & severity: filter: 'state = "ACTIVE" AND severity = "CRITICAL"' * By category: filter: 'category = "OPEN_FIREWALL"' (or substring match: 'category : "FIREWALL"') * By resource: filter: 'resource_name = "//compute.googleapis.com/projects/my-proj/zones/us-central1-a/instances/my-vm"' * By CVE: filter: 'vulnerability.cve.id = "CVE-2023-12345"' * By time: filter: 'event_time >= "2026-08-01T00:00:00Z"'

Single Finding Point Lookup: There is currently no dedicated get_finding tool. To retrieve a single finding by name, filter on its exact resource name: parent: "organizations/123/sources/456/locations/global" # or "projects/123/sources/-" filter: 'name = "organizations/123/sources/456/locations/global/findings/789"'

Best Practices for Token Management & Triage: * Recommended Triage FieldMask: Full finding records are very large. For exploratory triage and listing, it is STRONGLY RECOMMENDED to pass the following lightweight fieldMask: fieldMask: "finding.name,finding.category,finding.severity,finding.state,finding.event_time,finding.resource_name,finding.finding_class,finding.vulnerability.cve.id" Leave fieldMask unset only when performing in-depth investigation on specific findings. * Page Sizing: Unless performing bulk data export, specify a small pageSize (e.g. 5–10) to avoid overwhelming the conversation context.

The following code sample shows how to use curl to call the list_findings MCP tool.

Curl Request 
curl --location 'https://securitycenter.googleapis.com/mcp/investigate' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "list_findings",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for listing findings.

ListFindingsRequest

JSON representation 
{
  "parent": string,
  "filter": string,
  "orderBy": string,
  "fieldMask": string,
  "pageToken": string,
  "pageSize": integer
}
Fields
parent

string

Required. Name of the source the findings belong to. If no location is specified, the default is global. The following list shows some examples:

  • organizations/[organization_id]/sources/[source_id] + organizations/[organization_id]/sources/[source_id]/locations/[location_id]
  • folders/[folder_id]/sources/[source_id]
  • folders/[folder_id]/sources/[source_id]/locations/[location_id]
  • projects/[project_id]/sources/[source_id]
  • projects/[project_id]/sources/[source_id]/locations/[location_id]

To list across all sources provide a source_id of -. The following list shows some examples:

  • organizations/{organization_id}/sources/-
  • organizations/{organization_id}/sources/-/locations/{location_id}
  • folders/{folder_id}/sources/-
  • folders/{folder_id}/sources/-locations/{location_id}
  • projects/{projects_id}/sources/-
  • projects/{projects_id}/sources/-/locations/{location_id}
filter

string

Expression that defines the filter to apply across findings. The expression is a list of one or more restrictions combined via logical operators AND and OR. Parentheses are supported, and OR has higher precedence than AND.

Restrictions have the form <field> <operator> <value> and may have a - character in front of them to indicate negation. Examples include:

  • name
  • security_marks.marks.marka

The supported operators are:

  • = for all value types.
  • >, <, >=, <= for integer values.
  • :, meaning substring matching, for strings.

The supported value types are:

  • string literals in quotes.
  • integer literals without quotes.
  • boolean literals true and false without quotes.

The following field and operator combinations are supported:

  • name: =
  • parent: =, :
  • resource_name: =, :
  • state: =, :
  • category: =, :
  • external_uri: =, :
  • event_time: =, >, <, >=, <=

Usage: This should be milliseconds since epoch or an RFC3339 string. Examples: event_time = "2019-06-10T16:07:18-07:00" event_time = 1560208038000

  • severity: =, :
  • security_marks.marks: =, :
  • resource:
  • resource.name: =, :
  • resource.parent_name: =, :
  • resource.parent_display_name: =, :
  • resource.project_name: =, :
  • resource.project_display_name: =, :
  • resource.type: =, :
  • resource.folders.resource_folder: =, :
  • resource.display_name: =, :
orderBy

string

Expression that defines what fields and order to use for sorting. The string value should follow SQL syntax: comma separated list of fields. For example: "name,parent". The default sorting order is ascending. To specify descending order for a field, a suffix " desc" should be appended to the field name. For example: "name desc,parent". Redundant space characters in the syntax are insignificant. "name desc,parent" and " name desc , parent " are equivalent.

The following fields are supported: name parent state category resource_name event_time security_marks.marks
fieldMask

string (FieldMask format)

A field mask to specify the Finding fields to be listed in the response. An empty field mask will list all fields.
pageToken

string

The value returned by the last ListFindingsResponse; indicates that this is a continuation of a prior ListFindings call, and that the system should return the next page of data.
pageSize

integer

The maximum number of results to return in a single response. Default is 10, minimum is 1, maximum is 1000.

FieldMask

JSON representation 
{
  "paths": [
    string
  ]
}
Fields
paths[]

string

The set of field mask paths.

Output Schema

Response message for listing findings.

ListFindingsResponse

JSON representation 
{
  "listFindingsResults": [
    {
      object (ListFindingsResult)
    }
  ],
  "nextPageToken": string,
  "totalSize": integer
}
Fields
listFindingsResults[]

object (ListFindingsResult)

Findings matching the list request.
nextPageToken

string

Token to retrieve the next page of results, or empty if there are no more results.
totalSize

integer

The total number of findings matching the query.

ListFindingsResult

JSON representation 
{
  "finding": {
    object (Finding)
  },
  "resource": {
    object (Resource)
  }
}
Fields
finding

object (Finding)

Finding matching the search request.
resource

object (Resource)

Output only. Resource that is associated with this finding.

Finding

JSON representation 
{
  "name": string,
  "canonicalName": string,
  "parent": string,
  "resourceName": string,
  "state": enum (State),
  "category": string,
  "externalUri": string,
  "sourceProperties": {
    string: value,
    ...
  },
  "securityMarks": {
    object (SecurityMarks)
  },
  "eventTime": string,
  "createTime": string,
  "severity": enum (Severity),
  "mute": enum (Mute),
  "muteInfo": {
    object (MuteInfo)
  },
  "findingClass": enum (FindingClass),
  "indicator": {
    object (Indicator)
  },
  "vulnerability": {
    object (Vulnerability)
  },
  "muteUpdateTime": string,
  "externalSystems": {
    string: {
      object (ExternalSystem)
    },
    ...
  },
  "mitreAttack": {
    object (MitreAttack)
  },
  "access": {
    object (Access)
  },
  "connections": [
    {
      object (Connection)
    }
  ],
  "muteInitiator": string,
  "processes": [
    {
      object (Process)
    }
  ],
  "contacts": {
    string: {
      object (ContactDetails)
    },
    ...
  },
  "compliances": [
    {
      object (Compliance)
    }
  ],
  "parentDisplayName": string,
  "description": string,
  "exfiltration": {
    object (Exfiltration)
  },
  "iamBindings": [
    {
      object (IamBinding)
    }
  ],
  "nextSteps": string,
  "moduleName": string,
  "containers": [
    {
      object (Container)
    }
  ],
  "kubernetes": {
    object (Kubernetes)
  },
  "database": {
    object (Database)
  },
  "attackExposure": {
    object (AttackExposure)
  },
  "files": [
    {
      object (File)
    }
  ],
  "cloudDlpInspection": {
    object (CloudDlpInspection)
  },
  "cloudDlpDataProfile": {
    object (CloudDlpDataProfile)
  },
  "kernelRootkit": {
    object (KernelRootkit)
  },
  "orgPolicies": [
    {
      object (OrgPolicy)
    }
  ],
  "job": {
    object (Job)
  },
  "application": {
    object (Application)
  },
  "ipRules": {
    object (IpRules)
  },
  "backupDisasterRecovery": {
    object (BackupDisasterRecovery)
  },
  "securityPosture": {
    object (SecurityPosture)
  },
  "logEntries": [
    {
      object (LogEntry)
    }
  ],
  "loadBalancers": [
    {
      object (LoadBalancer)
    }
  ],
  "cloudArmor": {
    object (CloudArmor)
  },
  "notebook": {
    object (Notebook)
  },
  "toxicCombination": {
    object (ToxicCombination)
  },
  "groupMemberships": [
    {
      object (GroupMembership)
    }
  ],
  "disk": {
    object (Disk)
  },
  "dataAccessEvents": [
    {
      object (DataAccessEvent)
    }
  ],
  "dataFlowEvents": [
    {
      object (DataFlowEvent)
    }
  ],
  "networks": [
    {
      object (Network)
    }
  ],
  "dataRetentionDeletionEvents": [
    {
      object (DataRetentionDeletionEvent)
    }
  ],
  "affectedResources": {
    object (AffectedResources)
  },
  "aiModel": {
    object (AiModel)
  },
  "chokepoint": {
    object (Chokepoint)
  },
  "complianceDetails": {
    object (ComplianceDetails)
  },
  "vertexAi": {
    object (VertexAi)
  },
  "cryptoKeyName": string,
  "artifactGuardPolicies": {
    object (ArtifactGuardPolicies)
  },
  "secret": {
    object (Secret)
  },
  "externalExposure": {
    object (ExternalExposure)
  },
  "policyViolationSummary": {
    object (PolicyViolationSummary)
  },
  "agentDataAccessEvents": [
    {
      object (AgentDataAccessEvent)
    }
  ],
  "discoveredWorkload": {
    object (DiscoveredWorkload)
  },
  "agent": {
    object (Agent)
  },
  "agentSessions": [
    {
      object (AgentSession)
    }
  ],
  "agentAnomaly": {
    object (AgentAnomaly)
  },
  "iamDetails": {
    object (IamDetails)
  }
}
Fields
name

string

Identifier. The relative resource name of the finding. The following list shows some examples:

+ organizations/{organization_id}/sources/{source_id}/findings/{finding_id} + organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id} + folders/{folder_id}/sources/{source_id}/findings/{finding_id} + folders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id} + projects/{project_id}/sources/{source_id}/findings/{finding_id} + projects/{project_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}
canonicalName

string

Output only. The canonical name of the finding. The following list shows some examples:

+ organizations/{organization_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id} + folders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id} + projects/{project_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}

The prefix is the closest CRM ancestor of the resource associated with the finding.
parent

string

The relative resource name of the source and location the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. The following list shows some examples:

  • organizations/{organization_id}/sources/{source_id}
  • folders/{folders_id}/sources/{source_id}
  • projects/{projects_id}/sources/{source_id} + organizations/{organization_id}/sources/{source_id}/locations/{location_id}
  • folders/{folders_id}/sources/{source_id}/locations/{location_id}
  • projects/{projects_id}/sources/{source_id}/locations/{location_id}
resourceName

string

Immutable. For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string.
state

enum (State)

Output only. The state of the finding.
category

string

Immutable. The additional taxonomy group within findings from a given source. Example: "XSS_FLASH_INJECTION"
externalUri

string

The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL.
sourceProperties

map (key: string, value: value (Value format))

Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
securityMarks

object (SecurityMarks)

Output only. User specified security marks. These marks are entirely managed by the user and come from the SecurityMarks resource that belongs to the finding.
eventTime

string (Timestamp format)

The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
createTime

string (Timestamp format)

Output only. The time at which the finding was created in Security Command Center.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
severity

enum (Severity)

The severity of the finding. This field is managed by the source that writes the finding.
mute

enum (Mute)

Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute.
muteInfo

object (MuteInfo)

Output only. The mute information regarding this finding.
findingClass

enum (FindingClass)

The class of the finding.
indicator

object (Indicator)

Represents what's commonly known as an indicator of compromise (IoC) in computer forensics. This is an artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion. For more information, see Indicator of compromise.
vulnerability

object (Vulnerability)

Represents vulnerability-specific fields like CVE and CVSS scores. CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
muteUpdateTime

string (Timestamp format)

Output only. The most recent time this finding was muted or unmuted.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
externalSystems

map (key: string, value: object (ExternalSystem))

Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
mitreAttack

object (MitreAttack)

MITRE ATT&CK tactics and techniques related to this finding. See: https://attack.mitre.org
access

object (Access)

Access details associated with the finding, such as more information on the caller, which method was accessed, and from where.
connections[]

object (Connection)

Contains information about the IP connection associated with the finding.
muteInitiator

string

Records additional information about the mute operation, for example, the mute configuration that muted the finding and the user who muted the finding.
processes[]

object (Process)

Represents operating system processes associated with the Finding.
contacts

map (key: string, value: object (ContactDetails))

Output only. Map containing the points of contact for the given finding. The key represents the type of contact, while the value contains a list of all the contacts that pertain. Please refer to: https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories

{
  "security": {
    "contacts": [
      {
        "email": "person1@company.com"
      },
      {
        "email": "person2@company.com"
      }
    ]
  }
}

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
compliances[]

object (Compliance)

Contains compliance information for security standards associated to the finding.
parentDisplayName

string

Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics".
description

string

Contains more details about the finding.
exfiltration

object (Exfiltration)

Represents exfiltrations associated with the finding.
iamBindings[]

object (IamBinding)

Represents IAM bindings associated with the finding.
nextSteps

string

Steps to address the finding.
moduleName

string

Unique identifier of the module which generated the finding. Example: folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885
containers[]

object (Container)

Containers associated with the finding. This field provides information for both Kubernetes and non-Kubernetes containers.
kubernetes

object (Kubernetes)

Kubernetes resources associated with the finding.
database

object (Database)

Database associated with the finding.
attackExposure

object (AttackExposure)

The results of an attack path simulation relevant to this finding.
files[]

object (File)

File associated with the finding.
cloudDlpInspection

object (CloudDlpInspection)

Cloud Data Loss Prevention (Cloud DLP) inspection results that are associated with the finding.
cloudDlpDataProfile

object (CloudDlpDataProfile)

Cloud DLP data profile that is associated with the finding.
kernelRootkit

object (KernelRootkit)

Signature of the kernel rootkit.
orgPolicies[]

object (OrgPolicy)

Contains information about the org policies associated with the finding.
job

object (Job)

Job associated with the finding.
application

object (Application)

Represents an application associated with the finding.
ipRules

object (IpRules)

IP rules associated with the finding.
backupDisasterRecovery

object (BackupDisasterRecovery)

Fields related to Backup and DR findings.
securityPosture

object (SecurityPosture)

The security posture associated with the finding.
logEntries[]

object (LogEntry)

Log entries that are relevant to the finding.
loadBalancers[]

object (LoadBalancer)

The load balancers associated with the finding.
cloudArmor

object (CloudArmor)

Fields related to Cloud Armor findings.
notebook

object (Notebook)

Notebook associated with the finding.
toxicCombination

object (ToxicCombination)

Contains details about a group of security issues that, when the issues occur together, represent a greater risk than when the issues occur independently. A group of such issues is referred to as a toxic combination. This field cannot be updated. Its value is ignored in all update requests.
groupMemberships[]

object (GroupMembership)

Contains details about groups of which this finding is a member. A group is a collection of findings that are related in some way. This field cannot be updated. Its value is ignored in all update requests.
disk

object (Disk)

Disk associated with the finding.
dataAccessEvents[]

object (DataAccessEvent)

Data access events associated with the finding.
dataFlowEvents[]

object (DataFlowEvent)

Data flow events associated with the finding.
networks[]

object (Network)

Represents the VPC networks that the resource is attached to.
dataRetentionDeletionEvents[]

object (DataRetentionDeletionEvent)

Data retention deletion events associated with the finding.
affectedResources

object (AffectedResources)

AffectedResources associated with the finding.
aiModel

object (AiModel)

The AI model associated with the finding.
chokepoint

object (Chokepoint)

Contains details about a chokepoint, which is a resource or resource group where high-risk attack paths converge, based on attack path simulations. This field cannot be updated. Its value is ignored in all update requests.
complianceDetails

object (ComplianceDetails)

Details about the compliance implications of the finding.
vertexAi

object (VertexAi)

VertexAi associated with the finding.
cryptoKeyName

string

Output only. The name of the Cloud KMS key used to encrypt this finding, if any.
artifactGuardPolicies

object (ArtifactGuardPolicies)

ArtifactGuardPolicies associated with the finding.
secret

object (Secret)

Secret associated with the finding.
externalExposure

object (ExternalExposure)

External exposure associated with the finding.
policyViolationSummary

object (PolicyViolationSummary)

PolicyViolationSummary associated with the finding.
agentDataAccessEvents[]

object (AgentDataAccessEvent)

Agent data access events associated with the finding.
discoveredWorkload

object (DiscoveredWorkload)

DiscoveredWorkload associated with the finding.
agent

object (Agent)

Primary Agent that the specified finding was flagged for
agentSessions[]

object (AgentSession)

Conversational session(s) where the finding occurred.
agentAnomaly

object (AgentAnomaly)

Details about behavior anomalies detected in AI agents.
iamDetails

object (IamDetails)

IamDetails associated with the finding.

SourcePropertiesEntry

JSON representation 
{
  "key": string,
  "value": value
}
Fields
key

string
value

value (Value format)

Value

JSON representation 
{

  // Union field kind can be only one of the following:
  "nullValue": null,
  "numberValue": number,
  "stringValue": string,
  "boolValue": boolean,
  "structValue": {
    object
  },
  "listValue": array
  // End of list of possible types for union field kind.
}
Fields
Union field kind. The kind of value. kind can be only one of the following:
nullValue

null

Represents a JSON null.
numberValue

number

Represents a JSON number. Must not be NaN, Infinity or -Infinity, since those are not supported in JSON. This also cannot represent large Int64 values, since JSON format generally does not support them in its number type.
stringValue

string

Represents a JSON string.
boolValue

boolean

Represents a JSON boolean (true or false literal in JSON).
structValue

object (Struct format)

Represents a JSON object.
listValue

array (ListValue format)

Represents a JSON array.

Struct

JSON representation 
{
  "fields": {
    string: value,
    ...
  }
}
Fields
fields

map (key: string, value: value (Value format))

Unordered map of dynamically typed values.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

FieldsEntry

JSON representation 
{
  "key": string,
  "value": value
}
Fields
key

string
value

value (Value format)

ListValue

JSON representation 
{
  "values": [
    value
  ]
}
Fields
values[]

value (Value format)

Repeated field of dynamically typed values.

SecurityMarks

JSON representation 
{
  "name": string,
  "marks": {
    string: string,
    ...
  },
  "canonicalName": string
}
Fields
name

string

The relative resource name of the SecurityMarks. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name The following list shows some examples:

  • organizations/{organization_id}/assets/{asset_id}/securityMarks + organizations/{organization_id}/sources/{source_id}/findings/{finding_id}/securityMarks + organizations/{organization_id}/sources/{source_id}/locations/{location}/findings/{finding_id}/securityMarks
marks

map (key: string, value: string)

Mutable user specified security marks belonging to the parent resource. Constraints are as follows:

  • Keys and values are treated as case insensitive
  • Keys must be between 1 - 256 characters (inclusive)
  • Keys must be letters, numbers, underscores, or dashes
  • Values have leading and trailing whitespace trimmed, remaining characters must be between 1 - 4096 characters (inclusive)

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
canonicalName

string

The canonical name of the marks. The following list shows some examples:

  • organizations/{organization_id}/assets/{asset_id}/securityMarks + organizations/{organization_id}/sources/{source_id}/findings/{finding_id}/securityMarks + organizations/{organization_id}/sources/{source_id}/locations/{location}/findings/{finding_id}/securityMarks
  • folders/{folder_id}/assets/{asset_id}/securityMarks + folders/{folder_id}/sources/{source_id}/findings/{finding_id}/securityMarks + folders/{folder_id}/sources/{source_id}/locations/{location}/findings/{finding_id}/securityMarks
  • projects/{project_number}/assets/{asset_id}/securityMarks + projects/{project_number}/sources/{source_id}/findings/{finding_id}/securityMarks + projects/{project_number}/sources/{source_id}/locations/{location}/findings/{finding_id}/securityMarks

MarksEntry

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string
value

string

Timestamp

JSON representation 
{
  "seconds": string,
  "nanos": integer
}
Fields
seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
nanos

integer

Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

MuteInfo

JSON representation 
{
  "staticMute": {
    object (StaticMute)
  },
  "dynamicMuteRecords": [
    {
      object (DynamicMuteRecord)
    }
  ]
}
Fields
staticMute

object (StaticMute)

If set, the static mute applied to this finding. Static mutes override dynamic mutes. If unset, there is no static mute.
dynamicMuteRecords[]

object (DynamicMuteRecord)

The list of dynamic mute rules that currently match the finding.

StaticMute

JSON representation 
{
  "state": enum (Mute),
  "applyTime": string
}
Fields
state

enum (Mute)

The static mute state. If the value is MUTED or UNMUTED, then the finding's overall mute state will have the same value.
applyTime

string (Timestamp format)

When the static mute was applied.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

DynamicMuteRecord

JSON representation 
{
  "muteConfig": string,
  "matchTime": string
}
Fields
muteConfig

string

The relative resource name of the mute rule, represented by a mute config, that created this record, for example organizations/123/muteConfigs/mymuteconfig or organizations/123/locations/global/muteConfigs/mymuteconfig.
matchTime

string (Timestamp format)

When the dynamic mute rule first matched the finding.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Indicator

JSON representation 
{
  "ipAddresses": [
    string
  ],
  "domains": [
    string
  ],
  "signatures": [
    {
      object (ProcessSignature)
    }
  ],
  "uris": [
    string
  ]
}
Fields
ipAddresses[]

string

The list of IP addresses that are associated with the finding.
domains[]

string

List of domains associated to the Finding.
signatures[]

object (ProcessSignature)

The list of matched signatures indicating that the given process is present in the environment.
uris[]

string

The list of URIs associated to the Findings.

ProcessSignature

JSON representation 
{
  "signatureType": enum (SignatureType),

  // Union field signature can be only one of the following:
  "memoryHashSignature": {
    object (MemoryHashSignature)
  },
  "yaraRuleSignature": {
    object (YaraRuleSignature)
  }
  // End of list of possible types for union field signature.
}
Fields
signatureType

enum (SignatureType)

Describes the type of resource associated with the signature.
Union field signature. The signature. signature can be only one of the following:
memoryHashSignature

object (MemoryHashSignature)

Signature indicating that a binary family was matched.
yaraRuleSignature

object (YaraRuleSignature)

Signature indicating that a YARA rule was matched.

MemoryHashSignature

JSON representation 
{
  "binaryFamily": string,
  "detections": [
    {
      object (Detection)
    }
  ]
}
Fields
binaryFamily

string

The binary family.
detections[]

object (Detection)

The list of memory hash detections contributing to the binary family match.

Detection

JSON representation 
{
  "binary": string,
  "percentPagesMatched": number
}
Fields
binary

string

The name of the binary associated with the memory hash signature detection.
percentPagesMatched

number

The percentage of memory page hashes in the signature that were matched.

YaraRuleSignature

JSON representation 
{
  "yaraRule": string
}
Fields
yaraRule

string

The name of the YARA rule.

Vulnerability

JSON representation 
{
  "cve": {
    object (Cve)
  },
  "offendingPackage": {
    object (Package)
  },
  "fixedPackage": {
    object (Package)
  },
  "securityBulletin": {
    object (SecurityBulletin)
  },
  "providerRiskScore": string,
  "reachable": boolean,
  "cwes": [
    {
      object (Cwe)
    }
  ]
}
Fields
cve

object (Cve)

CVE stands for Common Vulnerabilities and Exposures (https://cve.mitre.org/about/)
offendingPackage

object (Package)

The offending package is relevant to the finding.
fixedPackage

object (Package)

The fixed package is relevant to the finding.
securityBulletin

object (SecurityBulletin)

The security bulletin is relevant to this finding.
providerRiskScore

string (int64 format)

Provider provided risk_score based on multiple factors. The higher the risk score, the more risky the vulnerability is.
reachable

boolean

Represents whether the vulnerability is reachable (detected via static analysis)
cwes[]

object (Cwe)

Represents one or more Common Weakness Enumeration (CWE) information on this vulnerability.

Cve

JSON representation 
{
  "id": string,
  "references": [
    {
      object (Reference)
    }
  ],
  "cvssv3": {
    object (Cvssv3)
  },
  "upstreamFixAvailable": boolean,
  "impact": enum (RiskRating),
  "exploitationActivity": enum (ExploitationActivity),
  "observedInTheWild": boolean,
  "zeroDay": boolean,
  "exploitReleaseDate": string,
  "firstExploitationDate": string
}
Fields
id

string

The unique identifier for the vulnerability. e.g. CVE-2021-34527
references[]

object (Reference)

Additional information about the CVE. e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
cvssv3

object (Cvssv3)

Describe Common Vulnerability Scoring System specified at https://www.first.org/cvss/v3.1/specification-document
upstreamFixAvailable

boolean

Whether upstream fix is available for the CVE.
impact

enum (RiskRating)

The potential impact of the vulnerability if it was to be exploited.
exploitationActivity

enum (ExploitationActivity)

The exploitation activity of the vulnerability in the wild.
observedInTheWild

boolean

Whether or not the vulnerability has been observed in the wild.
zeroDay

boolean

Whether or not the vulnerability was zero day when the finding was published.
exploitReleaseDate

string (Timestamp format)

Date the first publicly available exploit or PoC was released.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
firstExploitationDate

string (Timestamp format)

Date of the earliest known exploitation.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Reference

JSON representation 
{
  "source": string,
  "uri": string
}
Fields
source

string

Source of the reference e.g. NVD
uri

string

Uri for the mentioned source e.g. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527.

Cvssv3

JSON representation 
{
  "baseScore": number,
  "attackVector": enum (AttackVector),
  "attackComplexity": enum (AttackComplexity),
  "privilegesRequired": enum (PrivilegesRequired),
  "userInteraction": enum (UserInteraction),
  "scope": enum (Scope),
  "confidentialityImpact": enum (Impact),
  "integrityImpact": enum (Impact),
  "availabilityImpact": enum (Impact)
}
Fields
baseScore

number

The base score is a function of the base metric scores.
attackVector

enum (AttackVector)

Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible.
attackComplexity

enum (AttackComplexity)

This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.
privilegesRequired

enum (PrivilegesRequired)

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.
userInteraction

enum (UserInteraction)

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.
scope

enum (Scope)

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.
confidentialityImpact

enum (Impact)

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.
integrityImpact

enum (Impact)

This metric measures the impact to integrity of a successfully exploited vulnerability.
availabilityImpact

enum (Impact)

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

Package

JSON representation 
{
  "packageName": string,
  "cpeUri": string,
  "packageType": string,
  "packageVersion": string
}
Fields
packageName

string

The name of the package where the vulnerability was detected.
cpeUri

string

The CPE URI where the vulnerability was detected.
packageType

string

Type of package, for example, os, maven, or go.
packageVersion

string

The version of the package.

SecurityBulletin

JSON representation 
{
  "bulletinId": string,
  "submissionTime": string,
  "suggestedUpgradeVersion": string
}
Fields
bulletinId

string

ID of the bulletin corresponding to the vulnerability.
submissionTime

string (Timestamp format)

Submission time of this Security Bulletin.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
suggestedUpgradeVersion

string

This represents a version that the cluster receiving this notification should be upgraded to, based on its current version. For example, 1.15.0

Cwe

JSON representation 
{
  "id": string,
  "references": [
    {
      object (Reference)
    }
  ]
}
Fields
id

string

The CWE identifier, e.g. CWE-94
references[]

object (Reference)

Any reference to the details on the CWE, for example, https://cwe.mitre.org/data/definitions/94.html

ExternalSystemsEntry

JSON representation 
{
  "key": string,
  "value": {
    object (ExternalSystem)
  }
}
Fields
key

string
value

object (ExternalSystem)

ExternalSystem

JSON representation 
{
  "name": string,
  "assignees": [
    string
  ],
  "externalUid": string,
  "status": string,
  "externalSystemUpdateTime": string,
  "caseUri": string,
  "casePriority": string,
  "caseSla": string,
  "caseCreateTime": string,
  "caseCloseTime": string,
  "ticketInfo": {
    object (TicketInfo)
  }
}
Fields
name

string

Full resource name of the external system. The following list shows some examples:

  • organizations/1234/sources/5678/findings/123456/externalSystems/jira + organizations/1234/sources/5678/locations/us/findings/123456/externalSystems/jira
  • folders/1234/sources/5678/findings/123456/externalSystems/jira + folders/1234/sources/5678/locations/us/findings/123456/externalSystems/jira
  • projects/1234/sources/5678/findings/123456/externalSystems/jira + projects/1234/sources/5678/locations/us/findings/123456/externalSystems/jira
assignees[]

string

References primary/secondary etc assignees in the external system.
externalUid

string

The identifier that's used to track the finding's corresponding case in the external system.
status

string

The most recent status of the finding's corresponding case, as reported by the external system.
externalSystemUpdateTime

string (Timestamp format)

The time when the case was last updated, as reported by the external system.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
caseUri

string

The link to the finding's corresponding case in the external system.
casePriority

string

The priority of the finding's corresponding case in the external system.
caseSla

string (Timestamp format)

The SLA of the finding's corresponding case in the external system.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
caseCreateTime

string (Timestamp format)

The time when the case was created, as reported by the external system.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
caseCloseTime

string (Timestamp format)

The time when the case was closed, as reported by the external system.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
ticketInfo

object (TicketInfo)

Information about the ticket, if any, that is being used to track the resolution of the issue that is identified by this finding.

TicketInfo

JSON representation 
{
  "id": string,
  "assignee": string,
  "description": string,
  "uri": string,
  "status": string,
  "updateTime": string
}
Fields
id

string

The identifier of the ticket in the ticket system.
assignee

string

The assignee of the ticket in the ticket system.
description

string

The description of the ticket in the ticket system.
uri

string

The link to the ticket in the ticket system.
status

string

The latest status of the ticket, as reported by the ticket system.
updateTime

string (Timestamp format)

The time when the ticket was last updated, as reported by the ticket system.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

MitreAttack

JSON representation 
{
  "primaryTactic": enum (Tactic),
  "primaryTechniques": [
    enum (Technique)
  ],
  "additionalTactics": [
    enum (Tactic)
  ],
  "additionalTechniques": [
    enum (Technique)
  ],
  "version": string
}
Fields
primaryTactic

enum (Tactic)

The MITRE ATT&CK tactic most closely represented by this finding, if any.
primaryTechniques[]

enum (Technique)

The MITRE ATT&CK technique most closely represented by this finding, if any. primary_techniques is a repeated field because there are multiple levels of MITRE ATT&CK techniques. If the technique most closely represented by this finding is a sub-technique (e.g. SCANNING_IP_BLOCKS), both the sub-technique and its parent technique(s) will be listed (e.g. SCANNING_IP_BLOCKS, ACTIVE_SCANNING).
additionalTactics[]

enum (Tactic)

Additional MITRE ATT&CK tactics related to this finding, if any.
additionalTechniques[]

enum (Technique)

Additional MITRE ATT&CK techniques related to this finding, if any, along with any of their respective parent techniques.
version

string

The MITRE ATT&CK version referenced by the above fields. E.g. "8".

Access

JSON representation 
{
  "principalEmail": string,
  "callerIp": string,
  "callerIpGeo": {
    object (Geolocation)
  },
  "userAgentFamily": string,
  "userAgent": string,
  "serviceName": string,
  "methodName": string,
  "principalSubject": string,
  "serviceAccountKeyName": string,
  "serviceAccountDelegationInfo": [
    {
      object (ServiceAccountDelegationInfo)
    }
  ],
  "userName": string
}
Fields
principalEmail

string

Associated email, such as "foo@google.com".

The email address of the authenticated user or a service account acting on behalf of a third party principal making the request. For third party identity callers, the principal_subject field is populated instead of this field. For privacy reasons, the principal email address is sometimes redacted. For more information, see Caller identities in audit logs.
callerIp

string

Caller's IP address, such as "1.1.1.1".
callerIpGeo

object (Geolocation)

The caller IP's geolocation, which identifies where the call came from.
userAgentFamily

string

Type of user agent associated with the finding. For example, an operating system shell or an embedded or standalone application.
userAgent

string

The caller's user agent string associated with the finding.
serviceName

string

This is the API service that the service account made a call to, e.g. "iam.googleapis.com"
methodName

string

The method that the service account called, e.g. "SetIamPolicy".
principalSubject

string

A string that represents the principal_subject that is associated with the identity. Unlike principal_email, principal_subject supports principals that aren't associated with email addresses, such as third party principals. For most identities, the format is principal://iam.googleapis.com/{identity pool name}/subject/{subject}. Some GKE identities, such as GKE_WORKLOAD, FREEFORM, and GKE_HUB_WORKLOAD, still use the legacy format serviceAccount:{identity pool name}[{subject}].
serviceAccountKeyName

string

The name of the service account key that was used to create or exchange credentials when authenticating the service account that made the request. This is a scheme-less URI full resource name. For example:

"//iam.googleapis.com/projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}".
serviceAccountDelegationInfo[]

object (ServiceAccountDelegationInfo)

The identity delegation history of an authenticated service account that made the request. The serviceAccountDelegationInfo[] object contains information about the real authorities that try to access Google Cloud resources by delegating on a service account. When multiple authorities are present, they are guaranteed to be sorted based on the original ordering of the identity delegation events.
userName

string

A string that represents a username. The username provided depends on the type of the finding and is likely not an IAM principal. For example, this can be a system username if the finding is related to a virtual machine, or it can be an application login username.

Geolocation

JSON representation 
{
  "regionCode": string
}
Fields
regionCode

string

A CLDR.

ServiceAccountDelegationInfo

JSON representation 
{
  "principalEmail": string,
  "principalSubject": string
}
Fields
principalEmail

string

The email address of a Google account.
principalSubject

string

A string representing the principal_subject associated with the identity. As compared to principal_email, supports principals that aren't associated with email addresses, such as third party principals. For most identities, the format will be principal://iam.googleapis.com/{identity pool name}/subjects/{subject} except for some GKE identities (GKE_WORKLOAD, FREEFORM, GKE_HUB_WORKLOAD) that are still in the legacy format serviceAccount:{identity pool name}[{subject}]

Connection

JSON representation 
{
  "destinationIp": string,
  "destinationPort": integer,
  "sourceIp": string,
  "sourcePort": integer,
  "protocol": enum (Protocol)
}
Fields
destinationIp

string

Destination IP address. Not present for sockets that are listening and not connected.
destinationPort

integer

Destination port. Not present for sockets that are listening and not connected.
sourceIp

string

Source IP address.
sourcePort

integer

Source port.
protocol

enum (Protocol)

IANA Internet Protocol Number such as TCP(6) and UDP(17).

Process

JSON representation 
{
  "name": string,
  "binary": {
    object (File)
  },
  "libraries": [
    {
      object (File)
    }
  ],
  "script": {
    object (File)
  },
  "args": [
    string
  ],
  "argumentsTruncated": boolean,
  "envVariables": [
    {
      object (EnvironmentVariable)
    }
  ],
  "envVariablesTruncated": boolean,
  "pid": string,
  "parentPid": string,
  "userId": string
}
Fields
name

string

The process name, as displayed in utilities like top and ps. This name can be accessed through /proc/[pid]/comm and changed with prctl(PR_SET_NAME).
binary

object (File)

File information for the process executable.
libraries[]

object (File)

File information for libraries loaded by the process.
script

object (File)

When the process represents the invocation of a script, binary provides information about the interpreter, while script provides information about the script file provided to the interpreter.
args[]

string

Process arguments as JSON encoded strings.
argumentsTruncated

boolean

True if args is incomplete.
envVariables[]

object (EnvironmentVariable)

Process environment variables.
envVariablesTruncated

boolean

True if env_variables is incomplete.
pid

string (int64 format)

The process ID.
parentPid

string (int64 format)

The parent process ID.
userId

string (int64 format)

The ID of the user that executed the process. E.g. If this is the root user this will always be 0.

File

JSON representation 
{
  "path": string,
  "size": string,
  "sha256": string,
  "hashedSize": string,
  "partiallyHashed": boolean,
  "contents": string,
  "diskPath": {
    object (DiskPath)
  },
  "operations": [
    {
      object (FileOperation)
    }
  ],
  "fileLoadState": enum (FileLoadState)
}
Fields
path

string

Absolute path of the file as a JSON encoded string.
size

string (int64 format)

Size of the file in bytes.
sha256

string

SHA256 hash of the first hashed_size bytes of the file encoded as a hex string. If hashed_size == size, sha256 represents the SHA256 hash of the entire file.
hashedSize

string (int64 format)

The length in bytes of the file prefix that was hashed. If hashed_size == size, any hashes reported represent the entire file.
partiallyHashed

boolean

True when the hash covers only a prefix of the file.
contents

string

Prefix of the file contents as a JSON-encoded string.
diskPath

object (DiskPath)

Path of the file in terms of underlying disk/partition identifiers.
operations[]

object (FileOperation)

Operation(s) performed on a file.
fileLoadState

enum (FileLoadState)

The load state of the file.

DiskPath

JSON representation 
{
  "partitionUuid": string,
  "relativePath": string
}
Fields
partitionUuid

string

UUID of the partition (format https://wiki.archlinux.org/title/persistent_block_device_naming#by-uuid)
relativePath

string

Relative path of the file in the partition as a JSON encoded string. Example: /home/user1/executable_file.sh

FileOperation

JSON representation 
{
  "type": enum (OperationType)
}
Fields
type

enum (OperationType)

The type of the operation

EnvironmentVariable

JSON representation 
{
  "name": string,
  "val": string
}
Fields
name

string

Environment variable name as a JSON encoded string.
val

string

Environment variable value as a JSON encoded string.

ContactsEntry

JSON representation 
{
  "key": string,
  "value": {
    object (ContactDetails)
  }
}
Fields
key

string
value

object (ContactDetails)

ContactDetails

JSON representation 
{
  "contacts": [
    {
      object (Contact)
    }
  ]
}
Fields
contacts[]

object (Contact)

A list of contacts

Contact

JSON representation 
{
  "email": string
}
Fields
email

string

An email address. For example, "person123@company.com".

Compliance

JSON representation 
{
  "standard": string,
  "version": string,
  "ids": [
    string
  ]
}
Fields
standard

string

Industry-wide compliance standards or benchmarks, such as CIS, PCI, and OWASP.
version

string

Version of the standard or benchmark, for example, 1.1
ids[]

string

Policies within the standard or benchmark, for example, A.12.4.1

Exfiltration

JSON representation 
{
  "sources": [
    {
      object (ExfilResource)
    }
  ],
  "targets": [
    {
      object (ExfilResource)
    }
  ],
  "totalExfiltratedBytes": string
}
Fields
sources[]

object (ExfilResource)

If there are multiple sources, then the data is considered "joined" between them. For instance, BigQuery can join multiple tables, and each table would be considered a source.
targets[]

object (ExfilResource)

If there are multiple targets, each target would get a complete copy of the "joined" source data.
totalExfiltratedBytes

string (int64 format)

Total exfiltrated bytes processed for the entire job.

ExfilResource

JSON representation 
{
  "name": string,
  "components": [
    string
  ]
}
Fields
name

string

The resource's full resource name.
components[]

string

Subcomponents of the asset that was exfiltrated, like URIs used during exfiltration, table names, databases, and filenames. For example, multiple tables might have been exfiltrated from the same Cloud SQL instance, or multiple files might have been exfiltrated from the same Cloud Storage bucket.

IamBinding

JSON representation 
{
  "action": enum (Action),
  "role": string,
  "member": string
}
Fields
action

enum (Action)

The action that was performed on a Binding.
role

string

Role that is assigned to "members". For example, "roles/viewer", "roles/editor", or "roles/owner".
member

string

A single identity requesting access for a Cloud Platform resource, for example, "foo@google.com".

Container

JSON representation 
{
  "name": string,
  "uri": string,
  "imageId": string,
  "labels": [
    {
      object (Label)
    }
  ],
  "createTime": string
}
Fields
name

string

Name of the container.
uri

string

Container image URI provided when configuring a pod or container. This string can identify a container image version using mutable tags.
imageId

string

Optional container image ID, if provided by the container runtime. Uniquely identifies the container image launched using a container image digest.
labels[]

object (Label)

Container labels, as provided by the container runtime.
createTime

string (Timestamp format)

The time that the container was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Label

JSON representation 
{
  "name": string,
  "value": string
}
Fields
name

string

Name of the label.
value

string

Value that corresponds to the label's name.

Kubernetes

JSON representation 
{
  "pods": [
    {
      object (Pod)
    }
  ],
  "nodes": [
    {
      object (Node)
    }
  ],
  "nodePools": [
    {
      object (NodePool)
    }
  ],
  "roles": [
    {
      object (Role)
    }
  ],
  "bindings": [
    {
      object (Binding)
    }
  ],
  "accessReviews": [
    {
      object (AccessReview)
    }
  ],
  "objects": [
    {
      object (Object)
    }
  ]
}
Fields
pods[]

object (Pod)

Kubernetes Pods associated with the finding. This field contains Pod records for each container that is owned by a Pod.
nodes[]

object (Node)

Provides Kubernetes node information.
nodePools[]

object (NodePool)

GKE node pools associated with the finding. This field contains node pool information for each node, when it is available.
roles[]

object (Role)

Provides Kubernetes role information for findings that involve Roles or ClusterRoles.
bindings[]

object (Binding)

Provides Kubernetes role binding information for findings that involve RoleBindings or ClusterRoleBindings.
accessReviews[]

object (AccessReview)

Provides information on any Kubernetes access reviews (privilege checks) relevant to the finding.
objects[]

object (Object)

Kubernetes objects related to the finding.

Pod

JSON representation 
{
  "ns": string,
  "name": string,
  "labels": [
    {
      object (Label)
    }
  ],
  "containers": [
    {
      object (Container)
    }
  ]
}
Fields
ns

string

Kubernetes Pod namespace.
name

string

Kubernetes Pod name.
labels[]

object (Label)

Pod labels. For Kubernetes containers, these are applied to the container.
containers[]

object (Container)

Pod containers associated with this finding, if any.

Node

JSON representation 
{
  "name": string
}
Fields
name

string

Full resource name of the Compute Engine VM running the cluster node.

NodePool

JSON representation 
{
  "name": string,
  "nodes": [
    {
      object (Node)
    }
  ]
}
Fields
name

string

Kubernetes node pool name.
nodes[]

object (Node)

Nodes associated with the finding.

Role

JSON representation 
{
  "kind": enum (Kind),
  "ns": string,
  "name": string
}
Fields
kind

enum (Kind)

Role type.
ns

string

Role namespace.
name

string

Role name.

Binding

JSON representation 
{
  "ns": string,
  "name": string,
  "role": {
    object (Role)
  },
  "subjects": [
    {
      object (Subject)
    }
  ]
}
Fields
ns

string

Namespace for the binding.
name

string

Name for the binding.
role

object (Role)

The Role or ClusterRole referenced by the binding.
subjects[]

object (Subject)

Represents one or more subjects that are bound to the role. Not always available for PATCH requests.

Subject

JSON representation 
{
  "kind": enum (AuthType),
  "ns": string,
  "name": string
}
Fields
kind

enum (AuthType)

Authentication type for the subject.
ns

string

Namespace for the subject.
name

string

Name for the subject.

AccessReview

JSON representation 
{
  "group": string,
  "ns": string,
  "name": string,
  "resource": string,
  "subresource": string,
  "verb": string,
  "version": string
}
Fields
group

string

The API group of the resource. "*" means all.
ns

string

Namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces. Both are represented by "" (empty).
name

string

The name of the resource being requested. Empty means all.
resource

string

The optional resource type requested. "*" means all.
subresource

string

The optional subresource type.
verb

string

A Kubernetes resource API verb, like get, list, watch, create, update, delete, proxy. "*" means all.
version

string

The API version of the resource. "*" means all.

Object

JSON representation 
{
  "group": string,
  "kind": string,
  "ns": string,
  "name": string,
  "containers": [
    {
      object (Container)
    }
  ]
}
Fields
group

string

Kubernetes object group, such as "policy.k8s.io/v1".
kind

string

Kubernetes object kind, such as "Namespace".
ns

string

Kubernetes object namespace. Must be a valid DNS label. Named "ns" to avoid collision with C++ namespace keyword. For details see https://kubernetes.io/docs/tasks/administer-cluster/namespaces/.
name

string

Kubernetes object name. For details see https://kubernetes.io/docs/concepts/overview/working-with-objects/names/.
containers[]

object (Container)

Pod containers associated with this finding, if any.

Database

JSON representation 
{
  "name": string,
  "displayName": string,
  "userName": string,
  "query": string,
  "grantees": [
    string
  ],
  "version": string
}
Fields
name

string

Some database resources may not have the full resource name populated because these resource types are not yet supported by Cloud Asset Inventory (e.g. Cloud SQL databases). In these cases only the display name will be provided. The full resource name of the database that the user connected to, if it is supported by Cloud Asset Inventory.
displayName

string

The human-readable name of the database that the user connected to.
userName

string

The username used to connect to the database. The username might not be an IAM principal and does not have a set format.
query

string

The SQL statement that is associated with the database access.
grantees[]

string

The target usernames, roles, or groups of an SQL privilege grant, which is not an IAM policy change.
version

string

The version of the database, for example, POSTGRES_14. See the complete list.

AttackExposure

JSON representation 
{
  "score": number,
  "latestCalculationTime": string,
  "attackExposureResult": string,
  "state": enum (State),
  "exposedHighValueResourcesCount": integer,
  "exposedMediumValueResourcesCount": integer,
  "exposedLowValueResourcesCount": integer
}
Fields
score

number

A number between 0 (inclusive) and infinity that represents how important this finding is to remediate. The higher the score, the more important it is to remediate.
latestCalculationTime

string (Timestamp format)

The most recent time the attack exposure was updated on this finding.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
attackExposureResult

string

The resource name of the attack path simulation result that contains the details regarding this attack exposure score. Example: organizations/123/simulations/456/attackExposureResults/789
state

enum (State)

Output only. What state this AttackExposure is in. This captures whether or not an attack exposure has been calculated or not.
exposedHighValueResourcesCount

integer

The number of high value resources that are exposed as a result of this finding.
exposedMediumValueResourcesCount

integer

The number of medium value resources that are exposed as a result of this finding.
exposedLowValueResourcesCount

integer

The number of high value resources that are exposed as a result of this finding.

CloudDlpInspection

JSON representation 
{
  "inspectJob": string,
  "infoType": string,
  "infoTypeCount": string,
  "fullScan": boolean
}
Fields
inspectJob

string

Name of the inspection job, for example, projects/123/locations/europe/dlpJobs/i-8383929.
infoType

string

The type of information (or infoType) found, for example, EMAIL_ADDRESS or STREET_ADDRESS.
infoTypeCount

string (int64 format)

The number of times Cloud DLP found this infoType within this job and resource.
fullScan

boolean

Whether Cloud DLP scanned the complete resource or a sampled subset.

CloudDlpDataProfile

JSON representation 
{
  "dataProfile": string,
  "parentType": enum (ParentType),
  "infoTypes": [
    {
      object (InfoType)
    }
  ]
}
Fields
dataProfile

string

Name of the data profile, for example, projects/123/locations/europe/tableProfiles/8383929.
parentType

enum (ParentType)

The resource hierarchy level at which the data profile was generated.
infoTypes[]

object (InfoType)

Type of information detected by SDP. Info type includes name, version and sensitivity of the detected information type.

InfoType

JSON representation 
{
  "name": string,
  "version": string,
  "sensitivityScore": {
    object (SensitivityScore)
  }
}
Fields
name

string

Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/sensitive-data-protection/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern [A-Za-z0-9$_-]{1,64}.
version

string

Optional version name for this InfoType.
sensitivityScore

object (SensitivityScore)

Optional custom sensitivity for this InfoType. This only applies to data profiling.

SensitivityScore

JSON representation 
{
  "score": enum (SensitivityScoreLevel)
}
Fields
score

enum (SensitivityScoreLevel)

The sensitivity score applied to the resource.

KernelRootkit

JSON representation 
{
  "name": string,
  "unexpectedCodeModification": boolean,
  "unexpectedReadOnlyDataModification": boolean,
  "unexpectedFtraceHandler": boolean,
  "unexpectedKprobeHandler": boolean,
  "unexpectedKernelCodePages": boolean,
  "unexpectedSystemCallHandler": boolean,
  "unexpectedInterruptHandler": boolean,
  "unexpectedProcessesInRunqueue": boolean
}
Fields
name

string

Rootkit name, when available.
unexpectedCodeModification

boolean

True if unexpected modifications of kernel code memory are present.
unexpectedReadOnlyDataModification

boolean

True if unexpected modifications of kernel read-only data memory are present.
unexpectedFtraceHandler

boolean

True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.
unexpectedKprobeHandler

boolean

True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.
unexpectedKernelCodePages

boolean

True if kernel code pages that are not in the expected kernel or module code regions are present.
unexpectedSystemCallHandler

boolean

True if system call handlers that are are not in the expected kernel or module code regions are present.
unexpectedInterruptHandler

boolean

True if interrupt handlers that are are not in the expected kernel or module code regions are present.
unexpectedProcessesInRunqueue

boolean

True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

OrgPolicy

JSON representation 
{
  "name": string
}
Fields
name

string

Identifier. The resource name of the org policy. Example: "organizations/{organization_id}/policies/{constraint_name}"

Job

JSON representation 
{
  "name": string,
  "state": enum (JobState),
  "errorCode": integer,
  "location": string
}
Fields
name

string

The fully-qualified name for a job. e.g. projects/<project_id>/jobs/<job_id>
state

enum (JobState)

Output only. State of the job, such as RUNNING or PENDING.
errorCode

integer

Optional. If the job did not complete successfully, this field describes why.
location

string

Optional. Gives the location where the job ran, such as US or europe-west1

Application

JSON representation 
{
  "baseUri": string,
  "fullUri": string
}
Fields
baseUri

string

The base URI that identifies the network location of the application in which the vulnerability was detected. For example, http://example.com.
fullUri

string

The full URI with payload that could be used to reproduce the vulnerability. For example, http://example.com?p=aMmYgI6H.

IpRules

JSON representation 
{
  "direction": enum (Direction),
  "sourceIpRanges": [
    string
  ],
  "destinationIpRanges": [
    string
  ],
  "exposedServices": [
    string
  ],

  // Union field rules can be only one of the following:
  "allowed": {
    object (Allowed)
  },
  "denied": {
    object (Denied)
  }
  // End of list of possible types for union field rules.
}
Fields
direction

enum (Direction)

The direction that the rule is applicable to, one of ingress or egress.
sourceIpRanges[]

string

If source IP ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. Only supports IPv4.
destinationIpRanges[]

string

If destination IP ranges are specified, the firewall rule applies only to traffic that has a destination IP address in these ranges. These ranges must be expressed in CIDR format. Only supports IPv4.
exposedServices[]

string

Name of the network protocol service, such as FTP, that is exposed by the open port. Follows the naming convention available at: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml.
Union field rules. The list of allow rules specified by this firewall. Each rule specifies a protocol and port-range tuple that describes a permitted connection. rules can be only one of the following:
allowed

object (Allowed)

Tuple with allowed rules.
denied

object (Denied)

Tuple with denied rules.

Allowed

JSON representation 
{
  "ipRules": [
    {
      object (IpRule)
    }
  ]
}
Fields
ipRules[]

object (IpRule)

Optional. Optional list of allowed IP rules.

IpRule

JSON representation 
{
  "protocol": string,
  "portRanges": [
    {
      object (PortRange)
    }
  ]
}
Fields
protocol

string

The IP protocol this rule applies to. This value can either be one of the following well known protocol strings (TCP, UDP, ICMP, ESP, AH, IPIP, SCTP) or a string representation of the integer value.
portRanges[]

object (PortRange)

Optional. An optional list of ports to which this rule applies. This field is only applicable for the UDP or (S)TCP protocols. Each entry must be either an integer or a range including a min and max port number.

PortRange

JSON representation 
{
  "min": string,
  "max": string
}
Fields
min

string (int64 format)

Minimum port value.
max

string (int64 format)

Maximum port value.

Denied

JSON representation 
{
  "ipRules": [
    {
      object (IpRule)
    }
  ]
}
Fields
ipRules[]

object (IpRule)

Optional. Optional list of denied IP rules.

BackupDisasterRecovery

JSON representation 
{
  "backupTemplate": string,
  "policies": [
    string
  ],
  "host": string,
  "applications": [
    string
  ],
  "storagePool": string,
  "policyOptions": [
    string
  ],
  "profile": string,
  "appliance": string,
  "backupType": string,
  "backupCreateTime": string
}
Fields
backupTemplate

string

The name of a Backup and DR template which comprises one or more backup policies. See the Backup and DR documentation for more information. For example, snap-ov.
policies[]

string

The names of Backup and DR policies that are associated with a template and that define when to run a backup, how frequently to run a backup, and how long to retain the backup image. For example, onvaults.
host

string

The name of a Backup and DR host, which is managed by the backup and recovery appliance and known to the management console. The host can be of type Generic (for example, Compute Engine, SQL Server, Oracle DB, SMB file system, etc.), vCenter, or an ESX server. See the Backup and DR documentation on hosts for more information. For example, centos7-01.
applications[]

string

The names of Backup and DR applications. An application is a VM, database, or file system on a managed host monitored by a backup and recovery appliance. For example, centos7-01-vol00, centos7-01-vol01, centos7-01-vol02.
storagePool

string

The name of the Backup and DR storage pool that the backup and recovery appliance is storing data in. The storage pool could be of type Cloud, Primary, Snapshot, or OnVault. See the Backup and DR documentation on storage pools. For example, DiskPoolOne.
policyOptions[]

string

The names of Backup and DR advanced policy options of a policy applying to an application. See the Backup and DR documentation on policy options. For example, skipofflineappsincongrp, nounmap.
profile

string

The name of the Backup and DR resource profile that specifies the storage media for backups of application and VM data. See the Backup and DR documentation on profiles. For example, GCP.
appliance

string

The name of the Backup and DR appliance that captures, moves, and manages the lifecycle of backup data. For example, backup-server-57137.
backupType

string

The backup type of the Backup and DR image. For example, Snapshot, Remote Snapshot, OnVault.
backupCreateTime

string (Timestamp format)

The timestamp at which the Backup and DR backup was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

SecurityPosture

JSON representation 
{
  "name": string,
  "revisionId": string,
  "postureDeploymentResource": string,
  "postureDeployment": string,
  "changedPolicy": string,
  "policySet": string,
  "policy": string,
  "policyDriftDetails": [
    {
      object (PolicyDriftDetails)
    }
  ]
}
Fields
name

string

Name of the posture, for example, CIS-Posture.
revisionId

string

The version of the posture, for example, c7cfa2a8.
postureDeploymentResource

string

The project, folder, or organization on which the posture is deployed, for example, projects/{project_number}.
postureDeployment

string

The name of the posture deployment, for example, organizations/{org_id}/posturedeployments/{posture_deployment_id}.
changedPolicy

string

The name of the updated policy, for example, projects/{project_id}/policies/{constraint_name}.
policySet

string

The name of the updated policy set, for example, cis-policyset.
policy

string

The ID of the updated policy, for example, compute-policy-1.
policyDriftDetails[]

object (PolicyDriftDetails)

The details about a change in an updated policy that violates the deployed posture.

PolicyDriftDetails

JSON representation 
{
  "field": string,
  "expectedValue": string,
  "detectedValue": string
}
Fields
field

string

The name of the updated field, for example constraint.implementation.policy_rules[0].enforce
expectedValue

string

The value of this field that was configured in a posture, for example, true or allowed_values={"projects/29831892"}.
detectedValue

string

The detected value that violates the deployed posture, for example, false or allowed_values={"projects/22831892"}.

LogEntry

JSON representation 
{

  // Union field log_entry can be only one of the following:
  "cloudLoggingEntry": {
    object (CloudLoggingEntry)
  }
  // End of list of possible types for union field log_entry.
}
Fields
Union field log_entry. The log entry. log_entry can be only one of the following:
cloudLoggingEntry

object (CloudLoggingEntry)

An individual entry in a log stored in Cloud Logging.

CloudLoggingEntry

JSON representation 
{
  "insertId": string,
  "logId": string,
  "resourceContainer": string,
  "timestamp": string
}
Fields
insertId

string

A unique identifier for the log entry.
logId

string

The type of the log (part of log_name. log_name is the resource name of the log to which this log entry belongs). For example: cloudresourcemanager.googleapis.com/activity Note that this field is not URL-encoded, unlike in LogEntry.
resourceContainer

string

The organization, folder, or project of the monitored resource that produced this log entry.
timestamp

string (Timestamp format)

The time the event described by the log entry occurred.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

LoadBalancer

JSON representation 
{
  "name": string
}
Fields
name

string

The name of the load balancer associated with the finding.

CloudArmor

JSON representation 
{
  "securityPolicy": {
    object (SecurityPolicy)
  },
  "requests": {
    object (Requests)
  },
  "adaptiveProtection": {
    object (AdaptiveProtection)
  },
  "attack": {
    object (Attack)
  },
  "threatVector": string,
  "duration": string
}
Fields
securityPolicy

object (SecurityPolicy)

Information about the Google Cloud Armor security policy relevant to the finding.
requests

object (Requests)

Information about incoming requests evaluated by Google Cloud Armor security policies.
adaptiveProtection

object (AdaptiveProtection)

Information about potential Layer 7 DDoS attacks identified by Google Cloud Armor Adaptive Protection.
attack

object (Attack)

Information about DDoS attack volume and classification.
threatVector

string

Distinguish between volumetric & protocol DDoS attack and application layer attacks. For example, "L3_4" for Layer 3 and Layer 4 DDoS attacks, or "L_7" for Layer 7 DDoS attacks.
duration

string (Duration format)

Duration of attack from the start until the current moment (updated every 5 minutes).

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".

SecurityPolicy

JSON representation 
{
  "name": string,
  "type": string,
  "preview": boolean
}
Fields
name

string

The name of the Google Cloud Armor security policy, for example, "my-security-policy".
type

string

The type of Google Cloud Armor security policy for example, 'backend security policy', 'edge security policy', 'network edge security policy', or 'always-on DDoS protection'.
preview

boolean

Whether or not the associated rule or policy is in preview mode.

Requests

JSON representation 
{
  "ratio": number,
  "shortTermAllowed": integer,
  "longTermAllowed": integer,
  "longTermDenied": integer
}
Fields
ratio

number

For 'Increasing deny ratio', the ratio is the denied traffic divided by the allowed traffic. For 'Allowed traffic spike', the ratio is the allowed traffic in the short term divided by allowed traffic in the long term.
shortTermAllowed

integer

Allowed RPS (requests per second) in the short term.
longTermAllowed

integer

Allowed RPS (requests per second) over the long term.
longTermDenied

integer

Denied RPS (requests per second) over the long term.

AdaptiveProtection

JSON representation 
{
  "confidence": number
}
Fields
confidence

number

A score of 0 means that there is low confidence that the detected event is an actual attack. A score of 1 means that there is high confidence that the detected event is an attack. See the Adaptive Protection documentation for further explanation.

Attack

JSON representation 
{
  "volumePpsLong": string,
  "volumeBpsLong": string,
  "classification": string,
  "volumePps": integer,
  "volumeBps": integer
}
Fields
volumePpsLong

string (int64 format)

Total PPS (packets per second) volume of attack.
volumeBpsLong

string (int64 format)

Total BPS (bytes per second) volume of attack.
classification

string

Type of attack, for example, 'SYN-flood', 'NTP-udp', or 'CHARGEN-udp'.
volumePps
(deprecated)

integer

Total PPS (packets per second) volume of attack. Deprecated - refer to volume_pps_long instead.
volumeBps
(deprecated)

integer

Total BPS (bytes per second) volume of attack. Deprecated - refer to volume_bps_long instead.

Duration

JSON representation 
{
  "seconds": string,
  "nanos": integer
}
Fields
seconds

string (int64 format)

Signed seconds of the span of time. Must be from -315,576,000,000 to +315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
nanos

integer

Signed fractions of a second at nanosecond resolution of the span of time. Durations less than one second are represented with a 0 seconds field and a positive or negative nanos field. For durations of one second or more, a non-zero value for the nanos field must be of the same sign as the seconds field. Must be from -999,999,999 to +999,999,999 inclusive.

Notebook

JSON representation 
{
  "name": string,
  "service": string,
  "lastAuthor": string,
  "notebookUpdateTime": string
}
Fields
name

string

The name of the notebook.
service

string

The source notebook service, for example, "Colab Enterprise".
lastAuthor

string

The user ID of the latest author to modify the notebook.
notebookUpdateTime

string (Timestamp format)

The most recent time the notebook was updated.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

ToxicCombination

JSON representation 
{
  "attackExposureScore": number,
  "relatedFindings": [
    string
  ]
}
Fields
attackExposureScore

number

The Attack exposure score of this toxic combination. The score is a measure of how much this toxic combination exposes one or more high-value resources to potential attack.
relatedFindings[]

string

List of resource names of findings associated with this toxic combination. For example, organizations/123/sources/456/findings/789.

GroupMembership

JSON representation 
{
  "groupType": enum (GroupType),
  "groupId": string
}
Fields
groupType

enum (GroupType)

Type of group.
groupId

string

ID of the group.

Disk

JSON representation 
{
  "name": string
}
Fields
name

string

The name of the disk, for example, "https://www.googleapis.com/compute/v1/projects/{project-id}/zones/{zone-id}/disks/{disk-id}".

DataAccessEvent

JSON representation 
{
  "eventId": string,
  "principalEmail": string,
  "operation": enum (Operation),
  "eventTime": string
}
Fields
eventId

string

Unique identifier for data access event.
principalEmail

string

The email address of the principal that accessed the data. The principal could be a user account, service account, Google group, or other.
operation

enum (Operation)

The operation performed by the principal to access the data.
eventTime

string (Timestamp format)

Timestamp of data access event.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

DataFlowEvent

JSON representation 
{
  "eventId": string,
  "principalEmail": string,
  "operation": enum (Operation),
  "violatedLocation": string,
  "eventTime": string
}
Fields
eventId

string

Unique identifier for data flow event.
principalEmail

string

The email address of the principal that initiated the data flow event. The principal could be a user account, service account, Google group, or other.
operation

enum (Operation)

The operation performed by the principal for the data flow event.
violatedLocation

string

Non-compliant location of the principal or the data destination.
eventTime

string (Timestamp format)

Timestamp of data flow event.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Network

JSON representation 
{
  "name": string
}
Fields
name

string

The name of the VPC network resource, for example, //compute.googleapis.com/projects/my-project/global/networks/my-network.

DataRetentionDeletionEvent

JSON representation 
{
  "eventDetectionTime": string,
  "dataObjectCount": string,
  "maxRetentionAllowed": string,
  "minRetentionAllowed": string,
  "eventType": enum (EventType)
}
Fields
eventDetectionTime

string (Timestamp format)

Timestamp indicating when the event was detected.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
dataObjectCount

string (int64 format)

Number of objects that violated the policy for this resource. If the number is less than 1,000, then the value of this field is the exact number. If the number of objects that violated the policy is greater than or equal to 1,000, then the value of this field is 1000.
maxRetentionAllowed

string (Duration format)

Maximum duration of retention allowed from the DRD control. This comes from the DRD control where users set a max TTL for their data. For example, suppose that a user sets the max TTL for a Cloud Storage bucket to 90 days. However, an object in that bucket is 100 days old. In this case, a DataRetentionDeletionEvent will be generated for that Cloud Storage bucket, and the max_retention_allowed is 90 days.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
minRetentionAllowed

string (Duration format)

The minimum duration that the resource associated with this finding must be retained, as enforced by the DSPM retention control. The retention period begins from the resource's creation time. This field is populated only when the event_type is set to EVENT_TYPE_MIN_TTL_FROM_CREATION.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
eventType

enum (EventType)

Type of the DRD event.

AffectedResources

JSON representation 
{
  "count": string
}
Fields
count

string (int64 format)

The count of resources affected by the finding.

AiModel

JSON representation 
{
  "name": string,
  "domain": string,
  "library": string,
  "location": string,
  "publisher": string,
  "deploymentPlatform": enum (DeploymentPlatform),
  "displayName": string,
  "usageCategory": string
}
Fields
name

string

The name of the AI model, for example, gemini:1.0.0.
domain

string

The domain of the model, for example, image-classification.
library

string

The name of the model library, for example, transformers.
location

string

The region in which the model is used, for example, us-central1.
publisher

string

The publisher of the model, for example, google or nvidia.
deploymentPlatform

enum (DeploymentPlatform)

The platform on which the model is deployed.
displayName

string

The user defined display name of model. Ex. baseline-classification-model
usageCategory

string

The purpose of the model, for example, "Inference" or "Training".

Chokepoint

JSON representation 
{
  "relatedFindings": [
    string
  ]
}
Fields
relatedFindings[]

string

List of resource names of findings associated with this chokepoint. For example, organizations/123/sources/456/findings/789. This list will have at most 100 findings.

ComplianceDetails

JSON representation 
{
  "frameworks": [
    {
      object (Framework)
    }
  ],
  "cloudControl": {
    object (CloudControl)
  },
  "cloudControlDeploymentNames": [
    string
  ]
}
Fields
frameworks[]

object (Framework)

Details of Frameworks associated with the finding
cloudControl

object (CloudControl)

CloudControl associated with the finding
cloudControlDeploymentNames[]

string

Cloud Control Deployments associated with the finding. For example, organizations/123/locations/global/cloudControlDeployments/deploymentIdentifier

Framework

JSON representation 
{
  "name": string,
  "displayName": string,
  "category": [
    enum (FrameworkCategory)
  ],
  "type": enum (FrameworkType),
  "controls": [
    {
      object (Control)
    }
  ]
}
Fields
name

string

Name of the framework associated with the finding
displayName

string

Display name of the framework. For a standard framework, this will look like e.g. PCI DSS 3.2.1, whereas for a custom framework it can be a user defined string like MyFramework
category[]

enum (FrameworkCategory)

Category of the framework associated with the finding. E.g. Security Benchmark, or Assured Workloads
type

enum (FrameworkType)

Type of the framework associated with the finding, to specify whether the framework is built-in (pre-defined and immutable) or a custom framework defined by the customer (equivalent to security posture)
controls[]

object (Control)

The controls associated with the framework.

Control

JSON representation 
{
  "controlName": string,
  "displayName": string
}
Fields
controlName

string

Name of the Control
displayName

string

Display name of the control. For example, AU-02.

CloudControl

JSON representation 
{
  "cloudControlName": string,
  "type": enum (CloudControlType),
  "policyType": string,
  "version": integer
}
Fields
cloudControlName

string

Name of the CloudControl associated with the finding.
type

enum (CloudControlType)

Type of cloud control.
policyType

string

Policy type of the CloudControl
version

integer

Version of the Cloud Control

VertexAi

JSON representation 
{
  "datasets": [
    {
      object (Dataset)
    }
  ],
  "pipelines": [
    {
      object (Pipeline)
    }
  ]
}
Fields
datasets[]

object (Dataset)

Datasets associated with the finding.
pipelines[]

object (Pipeline)

Pipelines associated with the finding.

Dataset

JSON representation 
{
  "name": string,
  "displayName": string,
  "source": string
}
Fields
name

string

Resource name of the dataset, e.g. projects/{project}/locations/{location}/datasets/2094040236064505856
displayName

string

The user defined display name of dataset, e.g. plants-dataset
source

string

Data source, such as a BigQuery source URI, e.g. bq://scc-nexus-test.AIPPtest.gsod

Pipeline

JSON representation 
{
  "name": string,
  "displayName": string
}
Fields
name

string

Resource name of the pipeline, e.g. projects/{project}/locations/{location}/trainingPipelines/5253428229225578496
displayName

string

The user-defined display name of pipeline, e.g. plants-classification

ArtifactGuardPolicies

JSON representation 
{
  "resourceId": string,
  "failingPolicies": [
    {
      object (ArtifactGuardPolicy)
    }
  ]
}
Fields
resourceId

string

The ID of the resource that has policies configured.
failingPolicies[]

object (ArtifactGuardPolicy)

A list of artifact guard policies that the resource violated.

ArtifactGuardPolicy

JSON representation 
{
  "type": enum (ArtifactGuardPolicyType),
  "policyId": string,
  "failureReason": string
}
Fields
type

enum (ArtifactGuardPolicyType)

The type of the policy evaluation.
policyId

string

The ID of the failing policy, for example, "organizations/3392779/locations/global/policies/prod-policy".
failureReason

string

The reason for the policy failure, for example, "severity=HIGH AND max_vuln_count=2".

Secret

JSON representation 
{
  "type": string,
  "status": {
    object (SecretStatus)
  },

  // Union field location can be only one of the following:
  "environmentVariable": {
    object (SecretEnvironmentVariable)
  },
  "filePath": {
    object (SecretFilePath)
  }
  // End of list of possible types for union field location.
}
Fields
type

string

The type of secret, for example, GCP_API_KEY.
status

object (SecretStatus)

The status of the secret.
Union field location. The location of the secret. location can be only one of the following:
environmentVariable

object (SecretEnvironmentVariable)

The environment variable containing the secret.
filePath

object (SecretFilePath)

The file containing the secret.

SecretStatus

JSON representation 
{
  "lastUpdatedTime": string,
  "validity": enum (SecretValidity)
}
Fields
lastUpdatedTime

string (Timestamp format)

Time that the secret was found.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
validity

enum (SecretValidity)

The validity of the secret.

SecretEnvironmentVariable

JSON representation 
{
  "key": string
}
Fields
key

string

The environment variable name as a JSON encoded string. Note that the value is not included because the value contains the secret data, which is sensitive core content.

SecretFilePath

JSON representation 
{
  "path": string
}
Fields
path

string

Path to the file.

ExternalExposure

JSON representation 
{
  "privateIpAddress": string,
  "privatePort": string,
  "exposedService": string,
  "publicIpAddress": string,
  "publicPort": string,
  "exposedEndpoint": string,
  "loadBalancerFirewallPolicy": string,
  "serviceFirewallPolicy": string,
  "forwardingRule": string,
  "backendService": string,
  "instanceGroup": string,
  "networkEndpointGroup": string,
  "hostnameUri": string,
  "pscServiceAttachment": string,
  "pscNetworkAttachment": string,
  "internalBackendService": string,
  "backendBucket": string,
  "exposedApplication": string,
  "networkIngressFirewallPolicy": string,
  "httpResponse": [
    {
      object (HttpResponse)
    }
  ],
  "networkPathInsightsGenerationTime": string
}
Fields
privateIpAddress

string

Private IP address of the exposed endpoint.
privatePort

string

Port number associated with private IP address.
exposedService

string

The name and version of the service, for example, "Jupyter Notebook 6.14.0".
publicIpAddress

string

Public IP address of the exposed endpoint.
publicPort

string

Public port number of the exposed endpoint.
exposedEndpoint

string

The resource which is running the exposed service, for example, "//compute.googleapis.com/projects/{project-id}/zones/{zone}/instances/{instance}".
loadBalancerFirewallPolicy

string

The full resource name of the load balancer firewall policy, for example, "//compute.googleapis.com/projects/{project-id}/global/firewallPolicies/{policy-name}".
serviceFirewallPolicy

string

The full resource name of the firewall policy of the exposed service, for example, "//compute.googleapis.com/projects/{project-id}/global/firewallPolicies/{policy-name}".
forwardingRule

string

The full resource name of the forwarding rule, for example, "//compute.googleapis.com/projects/{project-id}/global/forwardingRules/{forwarding-rule-name}".
backendService

string

The full resource name of load balancer backend service, for example, "//compute.googleapis.com/projects/{project-id}/global/backendServices/{name}".
instanceGroup

string

The full resource name of the instance group, for example, "//compute.googleapis.com/projects/{project-id}/global/instanceGroups/{name}".
networkEndpointGroup

string

The full resource name of the network endpoint group, for example, "//compute.googleapis.com/projects/{project-id}/global/networkEndpointGroups/{name}".
hostnameUri

string

Hostname of the exposed application, for example, https://example.com/
pscServiceAttachment

string

The full resource name of the PSC (Private Service Connect) service attachment that the load balancer network endpoint group targets, for example, "//compute.googleapis.com/projects/{project-id}/regions/{region}/serviceAttachments/{name}"
pscNetworkAttachment

string

The full resource name of the PSC (Private Service Connect) network attachment that network interface controller is attached to, for example, "//compute.googleapis.com/projects/{project-id}/regions/{region}/networkAttachments/{name}"
internalBackendService

string

The full resource name of load balancer backend service in the internal project having resource exposed via PSC, for example, "//compute.googleapis.com/projects/{project-id}/global/backendServices/{name}".
backendBucket

string

The full resource name of the load balancer backend bucket, for example, "//compute.googleapis.com/projects/{project-id}/global/backendBuckets/{name}"
exposedApplication

string

The name and version of the exposed web application, for example, "Jenkins 2.184".
networkIngressFirewallPolicy

string

The full resource name of the network ingress firewall policy, for example, "//compute.googleapis.com/projects/{project-id}/global/firewallPolicies/{name}".
httpResponse[]

object (HttpResponse)

The http response returned by the web application.
networkPathInsightsGenerationTime

string (Timestamp format)

The timestamp when the network reachability trace was generated or verified.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

HttpResponse

JSON representation 
{
  "statusCode": string,
  "path": string
}
Fields
statusCode

string

The http response code returned by the web application, for example, 200.
path

string

The http path for which response code was returned by web application, for example, https://example.com/example.

PolicyViolationSummary

JSON representation 
{
  "policyViolationsCount": string,
  "conformantResourcesCount": string,
  "evaluationErrorsCount": string,
  "outOfScopeResourcesCount": string
}
Fields
policyViolationsCount

string (int64 format)

Count of child resources in violation of the policy.
conformantResourcesCount

string (int64 format)

Total number of child resources that conform to the policy.
evaluationErrorsCount

string (int64 format)

Number of child resources for which errors during evaluation occurred. The evaluation result for these child resources is effectively "unknown".
outOfScopeResourcesCount

string (int64 format)

Total count of child resources which were not in scope for evaluation.

AgentDataAccessEvent

JSON representation 
{
  "eventId": string,
  "principalSubject": string,
  "operation": enum (Operation),
  "eventTime": string
}
Fields
eventId

string

Unique identifier for data access event.
principalSubject

string

The agent principal that accessed the data.
operation

enum (Operation)

The operation performed by the principal to access the data.
eventTime

string (Timestamp format)

Timestamp of data access event.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

DiscoveredWorkload

JSON representation 
{
  "workloadType": enum (WorkloadType),
  "confidence": enum (Confidence),
  "detectedRelevantPackages": boolean,
  "detectedRelevantKeywords": boolean,
  "detectedRelevantHardware": boolean
}
Fields
workloadType

enum (WorkloadType)

The type of workload.
confidence

enum (Confidence)

The confidence in detection of this workload.
detectedRelevantPackages

boolean

A boolean flag set to true if installed packages strongly predict the workload type.
detectedRelevantKeywords

boolean

A boolean flag set to true if associated keywords strongly predict the workload type.
detectedRelevantHardware

boolean

A boolean flag set to true if associated hardware strongly predicts the workload type.

Agent

JSON representation 
{
  "id": string,
  "displayName": string
}
Fields
id

string

Identifier of the agent.
displayName

string

The user friendly name of the specific agent instance where the finding was detected, for example, "Banking Agent".

AgentSession

JSON representation 
{
  "sessionId": string
}
Fields
sessionId

string

The session ID of a conversation.

AgentAnomaly

JSON representation 
{
  "confidenceScore": number,
  "detectorReferences": [
    {
      object (DetectorReference)
    }
  ],
  "invocationReferences": [
    {
      object (InvocationReference)
    }
  ]
}
Fields
confidenceScore

number

The overall confidence score indicating the likelihood that this session contains a true anomaly. The score ranges from 0.0 to 1.0, where 1.0 signifies 100% confidence in the presence of an anomaly and 0.0 signifies 0% confidence.
detectorReferences[]

object (DetectorReference)

The list of references to specific detectors that identified anomalies within this session.
invocationReferences[]

object (InvocationReference)

References to the OpenTelemetry invocations.

DetectorReference

JSON representation 
{
  "severity": enum (Severity),
  "detectorId": string,
  "displayName": string,
  "explanation": string,
  "recommendation": string
}
Fields
severity

enum (Severity)

The severity of the detector.
detectorId

string

The unique identifier of the detector.
displayName

string

A human readable name for the detector, providing context on its purpose. For example, "ASI02: Tool Misuse", or "Excessive API Calls".
explanation

string

A detailed explanation generated by an LLM or the detector itself, describing why this specific anomaly was flagged. This provides rationale and context for the detection.
recommendation

string

Recommended steps or actions to remediate or investigate the anomaly flagged by this detector. These could include configuration changes, code adjustments, or further diagnostic procedures.

InvocationReference

JSON representation 
{
  "invocationId": string
}
Fields
invocationId

string

The unique identifier of the invocation.

IamDetails

JSON representation 
{
  "iamRolePermissions": [
    {
      object (IamRolePermission)
    }
  ]
}
Fields
iamRolePermissions[]

object (IamRolePermission)

A list of IAM permissions.

IamRolePermission

JSON representation 
{
  "name": string,
  "role": string
}
Fields
name

string

The name of the IAM permission, such as "storage.buckets.get".
role

string

Role that contains the IAM permission, such as "projects/my-project/roles/myCustomRole".

Resource

JSON representation 
{
  "name": string,
  "displayName": string,
  "type": string,
  "cloudProvider": enum (CloudProvider),
  "service": string,
  "location": string,
  "resourcePath": {
    object (ResourcePath)
  },
  "resourcePathString": string,
  "application": {
    object (Application)
  },
  "adcApplication": {
    object (AdcApplication)
  },
  "adcApplicationTemplate": {
    object (AdcApplicationTemplateRevision)
  },
  "adcSharedTemplate": {
    object (AdcSharedTemplateRevision)
  },

  // Union field cloud_provider_metadata can be only one of the following:
  "gcpMetadata": {
    object (GcpMetadata)
  },
  "awsMetadata": {
    object (AwsMetadata)
  },
  "azureMetadata": {
    object (AzureMetadata)
  }
  // End of list of possible types for union field cloud_provider_metadata.
}
Fields
name

string

The full resource name of the resource. See: https://cloud.google.com/apis/design/resource_names#full_resource_name
displayName

string

The human readable name of the resource.
type

string

The full resource type of the resource.
cloudProvider

enum (CloudProvider)

Indicates which cloud provider the finding is from.
service

string

The service or resource provider associated with the resource.
location

string

The region or location of the service (if applicable).
resourcePath

object (ResourcePath)

Provides the path to the resource within the resource hierarchy.
resourcePathString

string

A string representation of the resource path. For Google Cloud, it has the format of organizations/{organization_id}/folders/{folder_id}/folders/{folder_id}/projects/{project_id} where there can be any number of folders. For AWS, it has the format of org/{organization_id}/ou/{organizational_unit_id}/ou/{organizational_unit_id}/account/{account_id} where there can be any number of organizational units. For Azure, it has the format of mg/{management_group_id}/mg/{management_group_id}/subscription/{subscription_id}/rg/{resource_group_name} where there can be any number of management groups.
application

object (Application)

The App Hub application this resource belongs to.
adcApplication

object (AdcApplication)

The ADC application associated with the finding.
adcApplicationTemplate

object (AdcApplicationTemplateRevision)

The ADC template associated with the finding.
adcSharedTemplate

object (AdcSharedTemplateRevision)

The ADC shared template associated with the finding.
Union field cloud_provider_metadata. The metadata associated with the cloud provider. cloud_provider_metadata can be only one of the following:
gcpMetadata

object (GcpMetadata)

The Google Cloud metadata associated with the finding.
awsMetadata

object (AwsMetadata)

The AWS metadata associated with the finding.
azureMetadata

object (AzureMetadata)

The Azure metadata associated with the finding.

GcpMetadata

JSON representation 
{
  "project": string,
  "projectDisplayName": string,
  "parent": string,
  "parentDisplayName": string,
  "folders": [
    {
      object (Folder)
    }
  ],
  "organization": string
}
Fields
project

string

The full resource name of project that the resource belongs to.
projectDisplayName

string

The project ID that the resource belongs to.
parent

string

The full resource name of resource's parent.
parentDisplayName

string

The human readable name of resource's parent.
folders[]

object (Folder)

Output only. Contains a Folder message for each folder in the assets ancestry. The first folder is the deepest nested folder, and the last folder is the folder directly under the Organization.
organization

string

The name of the organization that the resource belongs to.

Folder

JSON representation 
{
  "resourceFolder": string,
  "resourceFolderDisplayName": string
}
Fields
resourceFolder

string

Full resource name of this folder. See: https://cloud.google.com/apis/design/resource_names#full_resource_name
resourceFolderDisplayName

string

The user defined display name for this folder.

AwsMetadata

JSON representation 
{
  "organization": {
    object (AwsOrganization)
  },
  "organizationalUnits": [
    {
      object (AwsOrganizationalUnit)
    }
  ],
  "account": {
    object (AwsAccount)
  }
}
Fields
organization

object (AwsOrganization)

The AWS organization associated with the resource.
organizationalUnits[]

object (AwsOrganizationalUnit)

A list of AWS organizational units associated with the resource, ordered from lowest level (closest to the account) to highest level.
account

object (AwsAccount)

The AWS account associated with the resource.

AwsOrganization

JSON representation 
{
  "id": string
}
Fields
id

string

The unique identifier (ID) for the organization. The regex pattern for an organization ID string requires "o-" followed by from 10 to 32 lowercase letters or digits.

AwsOrganizationalUnit

JSON representation 
{
  "id": string,
  "name": string
}
Fields
id

string

The unique identifier (ID) associated with this OU. The regex pattern for an organizational unit ID string requires "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that contains the OU). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits. For example, "ou-ab12-cd34ef56".
name

string

The friendly name of the OU.

AwsAccount

JSON representation 
{
  "id": string,
  "name": string
}
Fields
id

string

The unique identifier (ID) of the account, containing exactly 12 digits.
name

string

The friendly name of this account.

AzureMetadata

JSON representation 
{
  "managementGroups": [
    {
      object (AzureManagementGroup)
    }
  ],
  "subscription": {
    object (AzureSubscription)
  },
  "resourceGroup": {
    object (AzureResourceGroup)
  },
  "tenant": {
    object (AzureTenant)
  }
}
Fields
managementGroups[]

object (AzureManagementGroup)

A list of Azure management groups associated with the resource, ordered from lowest level (closest to the subscription) to highest level.
subscription

object (AzureSubscription)

The Azure subscription associated with the resource.
resourceGroup

object (AzureResourceGroup)

The Azure resource group associated with the resource.
tenant

object (AzureTenant)

The Azure Entra tenant associated with the resource.

AzureManagementGroup

JSON representation 
{
  "id": string,
  "displayName": string
}
Fields
id

string

The UUID of the Azure management group, for example, 20000000-0001-0000-0000-000000000000.
displayName

string

The display name of the Azure management group.

AzureSubscription

JSON representation 
{
  "id": string,
  "displayName": string
}
Fields
id

string

The UUID of the Azure subscription, for example, 291bba3f-e0a5-47bc-a099-3bdcb2a50a05.
displayName

string

The display name of the Azure subscription.

AzureResourceGroup

JSON representation 
{
  "id": string,
  "name": string
}
Fields
id

string

The ID of the Azure resource group.
name

string

The name of the Azure resource group. This is not a UUID.

AzureTenant

JSON representation 
{
  "id": string,
  "displayName": string
}
Fields
id

string

The ID of the Microsoft Entra tenant, for example, "a11aaa11-aa11-1aa1-11aa-1aaa11a".
displayName

string

The display name of the Azure tenant.

ResourcePath

JSON representation 
{
  "nodes": [
    {
      object (ResourcePathNode)
    }
  ]
}
Fields
nodes[]

object (ResourcePathNode)

The list of nodes that make the up resource path, ordered from lowest level to highest level.

ResourcePathNode

JSON representation 
{
  "nodeType": enum (ResourcePathNodeType),
  "id": string,
  "displayName": string
}
Fields
nodeType

enum (ResourcePathNodeType)

The type of resource this node represents.
id

string

The ID of the resource this node represents.
displayName

string

The display name of the resource this node represents.

Application

JSON representation 
{
  "name": string,
  "attributes": {
    object (Attributes)
  }
}
Fields
name

string

The resource name of an Application. Format: projects/{host-project-id}/locations/{location}/applications/{application-id}
attributes

object (Attributes)

Consumer provided attributes for the application

Attributes

JSON representation 
{
  "criticality": {
    object (Criticality)
  },
  "environment": {
    object (Environment)
  },
  "developerOwners": [
    {
      object (ContactInfo)
    }
  ],
  "operatorOwners": [
    {
      object (ContactInfo)
    }
  ],
  "businessOwners": [
    {
      object (ContactInfo)
    }
  ]
}
Fields
criticality

object (Criticality)

User-defined criticality information.
environment

object (Environment)

User-defined environment information.
developerOwners[]

object (ContactInfo)

Developer team that owns development and coding.
operatorOwners[]

object (ContactInfo)

Operator team that ensures runtime and operations.
businessOwners[]

object (ContactInfo)

Business team that ensures user needs are met and value is delivered

Criticality

JSON representation 
{
  "type": enum (CriticalityType)
}
Fields
type

enum (CriticalityType)

Criticality Type.

Environment

JSON representation 
{
  "type": enum (EnvironmentType)
}
Fields
type

enum (EnvironmentType)

Environment Type.

ContactInfo

JSON representation 
{
  "email": string
}
Fields
email

string

Email address of the contacts.

AdcApplication

JSON representation 
{
  "name": string,
  "attributes": {
    object (Attributes)
  }
}
Fields
name

string

The resource name of an ADC Application. Format: projects/{project}/locations/{location}/spaces/{space}/applications/{application}
attributes

object (Attributes)

Consumer provided attributes for the AppHub application.

AdcApplicationTemplateRevision

JSON representation 
{
  "name": string
}
Fields
name

string

The resource name of an ADC Application Template Revision. Format: projects/{project}/locations/{location}/spaces/{space}/applicationTemplates/{application_template}/revisions/{revision}

AdcSharedTemplateRevision

JSON representation 
{
  "name": string
}
Fields
name

string

The resource name of an ADC Shared Template Revision. Format: projects/{project}/locations/{location}/spaces/{space}/applicationTemplates/{application_template}/revisions/{revision}

State

The state of the finding.

Enums
STATE_UNSPECIFIED Unspecified state.
ACTIVE The finding requires attention and has not been addressed yet.
INACTIVE The finding has been fixed, triaged as a non-issue or otherwise addressed and is no longer active.

NullValue

Represents a JSON null.

NullValue is a sentinel, using an enum with only one value to represent the null value for the Value type union.

A field of type NullValue with any value other than 0 is considered invalid. Most ProtoJSON serializers will emit a Value with a null_value set as a JSON null regardless of the integer value, and so will round trip to a 0 value.

Enums
NULL_VALUE Null value.

Severity

The severity of the finding.

Enums
SEVERITY_UNSPECIFIED This value is used for findings when a source doesn't write a severity value.
CRITICAL

Vulnerability: A critical vulnerability is easily discoverable by an external actor, exploitable, and results in the direct ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. Examples include publicly accessible unprotected user data and public SSH access with weak or no passwords.

Threat: Indicates a threat that is able to access, modify, or delete data or execute unauthorized code within existing resources.
HIGH

Vulnerability: A high risk vulnerability can be easily discovered and exploited in combination with other vulnerabilities in order to gain direct access and the ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. An example is a database with weak or no passwords that is only accessible internally. This database could easily be compromised by an actor that had access to the internal network.

Threat: Indicates a threat that is able to create new computational resources in an environment but not able to access data or execute code in existing resources.
MEDIUM

Vulnerability: A medium risk vulnerability could be used by an actor to gain access to resources or privileges that enable them to eventually (through multiple steps or a complex exploit) gain access and the ability to execute arbitrary code or exfiltrate data. An example is a service account with access to more projects than it should have. If an actor gains access to the service account, they could potentially use that access to manipulate a project the service account was not intended to.

Threat: Indicates a threat that is able to cause operational impact but may not access data or execute unauthorized code.
LOW

Vulnerability: A low risk vulnerability hampers a security organization's ability to detect vulnerabilities or active threats in their deployment, or prevents the root cause investigation of security issues. An example is monitoring and logs being disabled for resource configurations and access.

Threat: Indicates a threat that has obtained minimal access to an environment but is not able to access data, execute code, or create resources.

Mute

Mute state a finding can be in.

Enums
MUTE_UNSPECIFIED Unspecified.
MUTED Finding has been muted.
UNMUTED Finding has been unmuted.
UNDEFINED Finding has never been muted/unmuted.

FindingClass

Represents what kind of Finding it is.

Enums
FINDING_CLASS_UNSPECIFIED Unspecified finding class.
THREAT Describes unwanted or malicious activity.
VULNERABILITY Describes a potential weakness in software that increases risk to Confidentiality & Integrity & Availability.
MISCONFIGURATION Describes a potential weakness in cloud resource/asset configuration that increases risk.
OBSERVATION Describes a security observation that is for informational purposes.
SCC_ERROR Describes an error that prevents some SCC functionality.
POSTURE_VIOLATION Describes a potential security risk due to a change in the security posture.
TOXIC_COMBINATION Describes a combination of security issues that represent a more severe security problem when taken together.
SENSITIVE_DATA_RISK Describes a potential security risk to data assets that contain sensitive data.
CHOKEPOINT Describes a resource or resource group where high risk attack paths converge, based on attack path simulations (APS).
EXTERNAL_EXPOSURE Describes a potential security risk due to the resource being exposed to the internet.
SECRET Describes a potential security risk due to plaintext credentials, keys, or tokens being exposed in an asset or workload.

SignatureType

Possible resource types to be associated with a signature.

Enums
SIGNATURE_TYPE_UNSPECIFIED The default signature type.
SIGNATURE_TYPE_PROCESS Used for signatures concerning processes.
SIGNATURE_TYPE_FILE Used for signatures concerning disks.

AttackVector

This metric reflects the context by which vulnerability exploitation is possible.

Enums
ATTACK_VECTOR_UNSPECIFIED Invalid value.
ATTACK_VECTOR_NETWORK The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet.
ATTACK_VECTOR_ADJACENT The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology.
ATTACK_VECTOR_LOCAL The vulnerable component is not bound to the network stack and the attacker's path is via read/write/execute capabilities.
ATTACK_VECTOR_PHYSICAL The attack requires the attacker to physically touch or manipulate the vulnerable component.

AttackComplexity

This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.

Enums
ATTACK_COMPLEXITY_UNSPECIFIED Invalid value.
ATTACK_COMPLEXITY_LOW Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.
ATTACK_COMPLEXITY_HIGH A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.

PrivilegesRequired

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

Enums
PRIVILEGES_REQUIRED_UNSPECIFIED Invalid value.
PRIVILEGES_REQUIRED_NONE The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
PRIVILEGES_REQUIRED_LOW The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
PRIVILEGES_REQUIRED_HIGH The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable component allowing access to component-wide settings and files.

UserInteraction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

Enums
USER_INTERACTION_UNSPECIFIED Invalid value.
USER_INTERACTION_NONE The vulnerable system can be exploited without interaction from any user.
USER_INTERACTION_REQUIRED Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.

Scope

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Enums
SCOPE_UNSPECIFIED Invalid value.
SCOPE_UNCHANGED An exploited vulnerability can only affect resources managed by the same security authority.
SCOPE_CHANGED An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component.

Impact

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack.

Enums
IMPACT_UNSPECIFIED Invalid value.
IMPACT_HIGH High impact.
IMPACT_LOW Low impact.
IMPACT_NONE No impact.

RiskRating

The possible values of impact of the vulnerability if it was to be exploited.

Enums
RISK_RATING_UNSPECIFIED Invalid or empty value.
LOW Exploitation would have little to no security impact.
MEDIUM Exploitation would enable attackers to perform activities, or could allow attackers to have a direct impact, but would require additional steps.
HIGH Exploitation would enable attackers to have a notable direct impact without needing to overcome any major mitigating factors.
CRITICAL Exploitation would fundamentally undermine the security of affected systems, enable actors to perform significant attacks with minimal effort, with little to no mitigating factors to overcome.

ExploitationActivity

The possible values of exploitation activity of the vulnerability in the wild.

Enums
EXPLOITATION_ACTIVITY_UNSPECIFIED Invalid or empty value.
WIDE Exploitation has been reported or confirmed to widely occur.
CONFIRMED Limited reported or confirmed exploitation activities.
AVAILABLE Exploit is publicly available.
ANTICIPATED No known exploitation activity, but has a high potential for exploitation.
NO_KNOWN No known exploitation activity.

Tactic

MITRE ATT&CK tactics that can be referenced by SCC findings. See: https://attack.mitre.org/tactics/enterprise/

Enums
TACTIC_UNSPECIFIED Unspecified value.
RECONNAISSANCE TA0043
RESOURCE_DEVELOPMENT TA0042
INITIAL_ACCESS TA0001
EXECUTION TA0002
PERSISTENCE TA0003
PRIVILEGE_ESCALATION TA0004
DEFENSE_EVASION TA0005
CREDENTIAL_ACCESS TA0006
DISCOVERY TA0007
LATERAL_MOVEMENT TA0008
COLLECTION TA0009
COMMAND_AND_CONTROL TA0011
EXFILTRATION TA0010
IMPACT TA0040

Technique

MITRE ATT&CK techniques that can be referenced by Security Command Center findings. See: https://attack.mitre.org/techniques/enterprise/

Enums
TECHNIQUE_UNSPECIFIED Unspecified value.
DATA_OBFUSCATION T1001
DATA_OBFUSCATION_STEGANOGRAPHY T1001.002
OS_CREDENTIAL_DUMPING T1003
OS_CREDENTIAL_DUMPING_PROC_FILESYSTEM T1003.007
OS_CREDENTIAL_DUMPING_ETC_PASSWORD_AND_ETC_SHADOW T1003.008
DATA_FROM_LOCAL_SYSTEM T1005
AUTOMATED_EXFILTRATION T1020
OBFUSCATED_FILES_OR_INFO T1027
STEGANOGRAPHY T1027.003
COMPILE_AFTER_DELIVERY T1027.004
COMMAND_OBFUSCATION T1027.010
SCHEDULED_TRANSFER T1029
SYSTEM_OWNER_USER_DISCOVERY T1033
MASQUERADING T1036
MATCH_LEGITIMATE_NAME_OR_LOCATION T1036.005
BOOT_OR_LOGON_INITIALIZATION_SCRIPTS T1037
STARTUP_ITEMS T1037.005
NETWORK_SERVICE_DISCOVERY T1046
SCHEDULED_TASK_JOB T1053
SCHEDULED_TASK_JOB_CRON T1053.003
CONTAINER_ORCHESTRATION_JOB T1053.007
PROCESS_INJECTION T1055
INPUT_CAPTURE T1056
INPUT_CAPTURE_KEYLOGGING T1056.001
PROCESS_DISCOVERY T1057
COMMAND_AND_SCRIPTING_INTERPRETER T1059
UNIX_SHELL T1059.004
PYTHON T1059.006
EXPLOITATION_FOR_PRIVILEGE_ESCALATION T1068
PERMISSION_GROUPS_DISCOVERY T1069
CLOUD_GROUPS T1069.003
INDICATOR_REMOVAL T1070
INDICATOR_REMOVAL_CLEAR_LINUX_OR_MAC_SYSTEM_LOGS T1070.002
INDICATOR_REMOVAL_CLEAR_COMMAND_HISTORY T1070.003
INDICATOR_REMOVAL_FILE_DELETION T1070.004
INDICATOR_REMOVAL_TIMESTOMP T1070.006
INDICATOR_REMOVAL_CLEAR_MAILBOX_DATA T1070.008
APPLICATION_LAYER_PROTOCOL T1071
DNS T1071.004
SOFTWARE_DEPLOYMENT_TOOLS T1072
VALID_ACCOUNTS T1078
DEFAULT_ACCOUNTS T1078.001
LOCAL_ACCOUNTS T1078.003
CLOUD_ACCOUNTS T1078.004
FILE_AND_DIRECTORY_DISCOVERY T1083
ACCOUNT_DISCOVERY_LOCAL_ACCOUNT T1087.001
PROXY T1090
EXTERNAL_PROXY T1090.002
MULTI_HOP_PROXY T1090.003
ACCOUNT_MANIPULATION T1098
ADDITIONAL_CLOUD_CREDENTIALS T1098.001
ADDITIONAL_CLOUD_ROLES T1098.003
SSH_AUTHORIZED_KEYS T1098.004
ADDITIONAL_CONTAINER_CLUSTER_ROLES T1098.006
MULTI_STAGE_CHANNELS T1104
INGRESS_TOOL_TRANSFER T1105
NATIVE_API T1106
BRUTE_FORCE T1110
AUTOMATED_COLLECTION T1119
SHARED_MODULES T1129
DATA_ENCODING T1132
STANDARD_ENCODING T1132.001
ACCESS_TOKEN_MANIPULATION T1134
TOKEN_IMPERSONATION_OR_THEFT T1134.001
CREATE_ACCOUNT T1136
LOCAL_ACCOUNT T1136.001
DEOBFUSCATE_DECODE_FILES_OR_INFO T1140
EXPLOIT_PUBLIC_FACING_APPLICATION T1190
SUPPLY_CHAIN_COMPROMISE T1195
COMPROMISE_SOFTWARE_DEPENDENCIES_AND_DEVELOPMENT_TOOLS T1195.001
EXPLOITATION_FOR_CLIENT_EXECUTION T1203
USER_EXECUTION T1204
EXPLOITATION_FOR_CREDENTIAL_ACCESS T1212
LINUX_AND_MAC_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION T1222.002
DOMAIN_POLICY_MODIFICATION T1484
DATA_DESTRUCTION T1485
DATA_ENCRYPTED_FOR_IMPACT T1486
SERVICE_STOP T1489
INHIBIT_SYSTEM_RECOVERY T1490
FIRMWARE_CORRUPTION T1495
RESOURCE_HIJACKING T1496
NETWORK_DENIAL_OF_SERVICE T1498
CLOUD_SERVICE_DISCOVERY T1526
STEAL_APPLICATION_ACCESS_TOKEN T1528
ACCOUNT_ACCESS_REMOVAL T1531
TRANSFER_DATA_TO_CLOUD_ACCOUNT T1537
CREATE_OR_MODIFY_SYSTEM_PROCESS T1543
EVENT_TRIGGERED_EXECUTION T1546
BOOT_OR_LOGON_AUTOSTART_EXECUTION T1547
KERNEL_MODULES_AND_EXTENSIONS T1547.006
SHORTCUT_MODIFICATION T1547.009
ABUSE_ELEVATION_CONTROL_MECHANISM T1548
ABUSE_ELEVATION_CONTROL_MECHANISM_SETUID_AND_SETGID T1548.001
ABUSE_ELEVATION_CONTROL_MECHANISM_SUDO_AND_SUDO_CACHING T1548.003
UNSECURED_CREDENTIALS T1552
CREDENTIALS_IN_FILES T1552.001
BASH_HISTORY T1552.003
PRIVATE_KEYS T1552.004
SUBVERT_TRUST_CONTROL T1553
INSTALL_ROOT_CERTIFICATE T1553.004
COMPROMISE_HOST_SOFTWARE_BINARY T1554
CREDENTIALS_FROM_PASSWORD_STORES T1555
MODIFY_AUTHENTICATION_PROCESS T1556
PLUGGABLE_AUTHENTICATION_MODULES T1556.003
MULTI_FACTOR_AUTHENTICATION T1556.006
IMPAIR_DEFENSES T1562
DISABLE_OR_MODIFY_TOOLS T1562.001
INDICATOR_BLOCKING T1562.006
DISABLE_OR_MODIFY_LINUX_AUDIT_SYSTEM T1562.012
HIDE_ARTIFACTS T1564
HIDDEN_FILES_AND_DIRECTORIES T1564.001
HIDDEN_USERS T1564.002
EXFILTRATION_OVER_WEB_SERVICE T1567
EXFILTRATION_TO_CLOUD_STORAGE T1567.002
DYNAMIC_RESOLUTION T1568
LATERAL_TOOL_TRANSFER T1570
HIJACK_EXECUTION_FLOW T1574
HIJACK_EXECUTION_FLOW_DYNAMIC_LINKER_HIJACKING T1574.006
MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE T1578
CREATE_SNAPSHOT T1578.001
CLOUD_INFRASTRUCTURE_DISCOVERY T1580
DEVELOP_CAPABILITIES T1587
DEVELOP_CAPABILITIES_MALWARE T1587.001
OBTAIN_CAPABILITIES T1588
OBTAIN_CAPABILITIES_MALWARE T1588.001
OBTAIN_CAPABILITIES_VULNERABILITIES T1588.006
ACTIVE_SCANNING T1595
SCANNING_IP_BLOCKS T1595.001
STAGE_CAPABILITIES T1608
UPLOAD_MALWARE T1608.001
CONTAINER_ADMINISTRATION_COMMAND T1609
DEPLOY_CONTAINER T1610
ESCAPE_TO_HOST T1611
CONTAINER_AND_RESOURCE_DISCOVERY T1613
REFLECTIVE_CODE_LOADING T1620
STEAL_OR_FORGE_AUTHENTICATION_CERTIFICATES T1649
FINANCIAL_THEFT T1657

Protocol

IANA Internet Protocol Number such as TCP(6) and UDP(17).

Enums
PROTOCOL_UNSPECIFIED Unspecified protocol (not HOPOPT).
ICMP Internet Control Message Protocol.
TCP Transmission Control Protocol.
UDP User Datagram Protocol.
GRE Generic Routing Encapsulation.
ESP Encap Security Payload.

OperationType

The type of the operation

Enums
OPERATION_TYPE_UNSPECIFIED The operation is unspecified.
OPEN Represents an open operation.
READ Represents a read operation.
RENAME Represents a rename operation.
WRITE Represents a write operation.
EXECUTE Represents an execute operation.

FileLoadState

The load state of the file.

Enums
FILE_LOAD_STATE_UNSPECIFIED Indicates that the file load state was not set or is not known. This is the default value.
LOADED_BY_PROCESS The file was in use by an active process during the scan.
NOT_LOADED_BY_PROCESS The file was not in use by any active process during the scan.

Action

The type of action performed on a Binding in a policy.

Enums
ACTION_UNSPECIFIED Unspecified.
ADD Addition of a Binding.
REMOVE Removal of a Binding.

Kind

Types of Kubernetes roles.

Enums
KIND_UNSPECIFIED Role type is not specified.
ROLE Kubernetes Role.
CLUSTER_ROLE Kubernetes ClusterRole.

AuthType

Auth types that can be used for the subject's kind field.

Enums
AUTH_TYPE_UNSPECIFIED Authentication is not specified.
USER User with valid certificate.
SERVICEACCOUNT Users managed by Kubernetes API with credentials stored as secrets.
GROUP Collection of users.

State

This enum defines the various states an AttackExposure can be in.

Enums
STATE_UNSPECIFIED The state is not specified.
CALCULATED The attack exposure has been calculated.
NOT_CALCULATED The attack exposure has not been calculated.

ParentType

Parents for configurations that produce data profile findings.

Enums
PARENT_TYPE_UNSPECIFIED Unspecified parent type.
ORGANIZATION Organization-level configurations.
PROJECT Project-level configurations.

SensitivityScoreLevel

Various sensitivity score levels for resources.

Enums
SENSITIVITY_SCORE_LEVEL_UNSPECIFIED Unused.
SENSITIVITY_LOW No sensitive information detected. The resource isn't publicly accessible.
SENSITIVITY_UNKNOWN Unable to determine sensitivity.
SENSITIVITY_MODERATE Medium risk. Contains personally identifiable information (PII), potentially sensitive data, or fields with free-text data that are at a higher risk of having intermittent sensitive data. Consider limiting access.
SENSITIVITY_HIGH High risk. Sensitive personally identifiable information (SPII) can be present. Exfiltration of data can lead to user data loss. Re-identification of users might be possible. Consider limiting usage and or removing SPII.

JobState

JobState represents the state of the job.

Enums
JOB_STATE_UNSPECIFIED Unspecified represents an unknown state and should not be used.
PENDING Job is scheduled and pending for run
RUNNING Job in progress
SUCCEEDED Job has completed with success
FAILED Job has completed but with failure

Direction

The type of direction that the rule is applicable to, one of ingress or egress. Not applicable to OPEN_X_PORT findings.

Enums
DIRECTION_UNSPECIFIED Unspecified direction value.
INGRESS Ingress direction value.
EGRESS Egress direction value.

GroupType

Possible types of groups.

Enums
GROUP_TYPE_UNSPECIFIED Default value.
GROUP_TYPE_TOXIC_COMBINATION Group represents a toxic combination.
GROUP_TYPE_CHOKEPOINT Group represents a chokepoint.

Operation

The operation of a data access event.

Enums
OPERATION_UNSPECIFIED The operation is unspecified.
READ Represents a read operation.
MOVE Represents a move operation.
COPY Represents a copy operation.

Operation

The operation of a data flow event.

Enums
OPERATION_UNSPECIFIED The operation is unspecified.
READ Represents a read operation.
MOVE Represents a move operation.
COPY Represents a copy operation.

EventType

Type of the DRD event.

Enums
EVENT_TYPE_UNSPECIFIED Unspecified event type.
EVENT_TYPE_MAX_TTL_EXCEEDED Deprecated: This field is pending removal. Use EVENT_TYPE_MAX_TTL_FROM_CREATION or EVENT_TYPE_MAX_TTL_FROM_LAST_MODIFICATION instead.
EVENT_TYPE_MAX_TTL_FROM_CREATION Max TTL from the asset's creation time.
EVENT_TYPE_MAX_TTL_FROM_LAST_MODIFICATION Max TTL from the asset's last modification time.
EVENT_TYPE_MIN_TTL_FROM_CREATION Min TTL from the asset's creation time.

DeploymentPlatform

The platform on which the model is deployed.

Enums
DEPLOYMENT_PLATFORM_UNSPECIFIED Unspecified deployment platform.
VERTEX_AI Gemini Enterprise Agent Platform.
GKE Google Kubernetes Engine.
GCE Compute Engine.
FINE_TUNED_MODEL Fine tuned model.

FrameworkCategory

The category of the framework.

Enums
FRAMEWORK_CATEGORY_UNSPECIFIED Default value. This value is unused.
SECURITY_BENCHMARKS Security Benchmarks framework
ASSURED_WORKLOADS Assured Workloads framework
DATA_SECURITY Data Security framework
GOOGLE_BEST_PRACTICES Google Best Practices framework
CUSTOM_FRAMEWORK A user-created framework

FrameworkType

The type of the framework.

Enums
FRAMEWORK_TYPE_UNSPECIFIED Default value. This value is unused.
FRAMEWORK_TYPE_BUILT_IN The framework is a built-in framework if it is created and managed by GCP.
FRAMEWORK_TYPE_CUSTOM The framework is a custom framework if it is created and managed by the user.

CloudControlType

Type of cloud control.

Enums
CLOUD_CONTROL_TYPE_UNSPECIFIED Unspecified.
BUILT_IN Built in Cloud Control.
CUSTOM Custom Cloud Control.

ArtifactGuardPolicyType

The type of the policy.

Enums
ARTIFACT_GUARD_POLICY_TYPE_UNSPECIFIED Default value. This value is unused.
VULNERABILITY Vulnerability type.

SecretValidity

Captures the outcome of validation. Validation includes checks like confirming that an API key is active and not expired.

Enums
SECRET_VALIDITY_UNSPECIFIED Default value; no validation was attempted.
SECRET_VALIDITY_UNSUPPORTED There is no mechanism to validate the secret.
SECRET_VALIDITY_FAILED Validation is supported but the validation failed.
SECRET_VALIDITY_INVALID The secret is confirmed to be invalid.
SECRET_VALIDITY_VALID The secret is confirmed to be valid.

Operation

The operation of a data access event.

Enums
OPERATION_UNSPECIFIED The operation is unspecified.
READ Represents a read operation.
MOVE Represents a move operation.
COPY Represents a copy operation.

WorkloadType

The types of detected workloads.

Enums
WORKLOAD_TYPE_UNSPECIFIED Unspecified workload type
MCP_SERVER A workload of type MCP Server
AI_INFERENCE A workload of type AI Inference
AGENT A workload of type LLM Agent

Confidence

Confidence levels for workload detection.

Enums
CONFIDENCE_UNSPECIFIED Unspecified confidence level.
CONFIDENCE_HIGH High confidence in detection of a workload.

Severity

Severity levels for detectors.

Enums
SEVERITY_UNSPECIFIED Unspecified severity.
CRITICAL Critical severity.
HIGH High severity.
MEDIUM Medium severity.
LOW Low severity.

CloudProvider

The cloud provider the finding pertains to.

Enums
CLOUD_PROVIDER_UNSPECIFIED The cloud provider is unspecified.
GOOGLE_CLOUD_PLATFORM The cloud provider is Google Cloud.
AMAZON_WEB_SERVICES The cloud provider is Amazon Web Services.
MICROSOFT_AZURE The cloud provider is Microsoft Azure.

ResourcePathNodeType

The type of resource the node represents.

Enums
RESOURCE_PATH_NODE_TYPE_UNSPECIFIED Node type is unspecified.
GCP_ORGANIZATION The node represents a Google Cloud organization.
GCP_FOLDER The node represents a Google Cloud folder.
GCP_PROJECT The node represents a Google Cloud project.
AWS_ORGANIZATION The node represents an AWS organization.
AWS_ORGANIZATIONAL_UNIT The node represents an AWS organizational unit.
AWS_ACCOUNT The node represents an AWS account.
AZURE_MANAGEMENT_GROUP The node represents an Azure management group.
AZURE_SUBSCRIPTION The node represents an Azure subscription.
AZURE_RESOURCE_GROUP The node represents an Azure resource group.

CriticalityType

Criticality Type.

Enums
CRITICALITY_TYPE_UNSPECIFIED Unspecified type.
MISSION_CRITICAL Mission critical service, application or workload.
HIGH High impact.
MEDIUM Medium impact.
LOW Low impact.

EnvironmentType

Environment Type.

Enums
ENVIRONMENT_TYPE_UNSPECIFIED Unspecified type.
PRODUCTION Production environment.
STAGING Staging environment.
TEST Test environment.
DEVELOPMENT Development environment.

Tool Annotations

Tool annotations are sent to MCP clients to describe the basic risk of a given tool. Most clients treat these hints as untrusted, but they can be used to decide when a confirmation prompt might be sent to a user.

Along with the title string, the following boolean hints are defined as follows:

  • readOnlyHint: If true, the tool doesn't modify its environment. Default: false.
  • destructiveHint: If true, then the tool can perform destructive actions. If false, then the tool can only perform additive actions. Default: true.
  • idempotentHint: If true, then calling the tool repeatedly with the same arguments will have no additional effect on its environment. Default: false.
  • openWorldHint: If true, then the tool can interact with an 'open world' of external entities. If false, then the tool can only interact with internal entities. For example, a web search tool would be open world, while a memory tool would not be open world.

Destructive Hint: ❌ | Idempotent Hint: ✅ | Read Only Hint: ✅ | Open World Hint: ❌