feat: Add BigQuery export APIs that help you enable writing new/updated findings from Security Command Center to a BigQuery table in near-real time. You can then integrate the data into existing workflows and create custom analyses. You can enable this feature at the organization, folder, and project levels to export findings based on your requirements
PiperOrigin-RevId: 431905699pull/706/head
Google APIs
3 years ago
committed by
Copybara-Service
parent
47a7288961
commit
4c1b56fddf
8 changed files with 600 additions and 184 deletions
@ -0,0 +1,101 @@ |
||||
// Copyright 2022 Google LLC |
||||
// |
||||
// Licensed under the Apache License, Version 2.0 (the "License"); |
||||
// you may not use this file except in compliance with the License. |
||||
// You may obtain a copy of the License at |
||||
// |
||||
// http://www.apache.org/licenses/LICENSE-2.0 |
||||
// |
||||
// Unless required by applicable law or agreed to in writing, software |
||||
// distributed under the License is distributed on an "AS IS" BASIS, |
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
// See the License for the specific language governing permissions and |
||||
// limitations under the License. |
||||
|
||||
syntax = "proto3"; |
||||
|
||||
package google.cloud.securitycenter.v1; |
||||
|
||||
import "google/api/field_behavior.proto"; |
||||
import "google/api/resource.proto"; |
||||
import "google/protobuf/timestamp.proto"; |
||||
|
||||
option csharp_namespace = "Google.Cloud.SecurityCenter.V1"; |
||||
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter"; |
||||
option java_multiple_files = true; |
||||
option java_outer_classname = "BigQueryExportProto"; |
||||
option java_package = "com.google.cloud.securitycenter.v1"; |
||||
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1"; |
||||
option ruby_package = "Google::Cloud::SecurityCenter::V1"; |
||||
|
||||
// Configures how to deliver Findings to BigQuery Instance. |
||||
message BigQueryExport { |
||||
option (google.api.resource) = { |
||||
type: "securitycenter.googleapis.com/BigQueryExport" |
||||
pattern: "organizations/{organization}/bigQueryExports/{export}" |
||||
pattern: "folders/{folder}/bigQueryExports/{export}" |
||||
pattern: "projects/{project}/bigQueryExports/{export}" |
||||
}; |
||||
|
||||
// The relative resource name of this export. See: |
||||
// https://cloud.google.com/apis/design/resource_names#relative_resource_name. |
||||
// Example format: |
||||
// "organizations/{organization_id}/bigQueryExports/{export_id}" Example |
||||
// format: "folders/{folder_id}/bigQueryExports/{export_id}" Example format: |
||||
// "projects/{project_id}/bigQueryExports/{export_id}" |
||||
// This field is provided in responses, and is ignored when provided in create |
||||
// requests. |
||||
string name = 1; |
||||
|
||||
// The description of the export (max of 1024 characters). |
||||
string description = 2; |
||||
|
||||
// Expression that defines the filter to apply across create/update events |
||||
// of findings. The expression is a list of zero or more restrictions combined |
||||
// via logical operators `AND` and `OR`. Parentheses are supported, and `OR` |
||||
// has higher precedence than `AND`. |
||||
// |
||||
// Restrictions have the form `<field> <operator> <value>` and may have a |
||||
// `-` character in front of them to indicate negation. The fields map to |
||||
// those defined in the corresponding resource. |
||||
// |
||||
// The supported operators are: |
||||
// |
||||
// * `=` for all value types. |
||||
// * `>`, `<`, `>=`, `<=` for integer values. |
||||
// * `:`, meaning substring matching, for strings. |
||||
// |
||||
// The supported value types are: |
||||
// |
||||
// * string literals in quotes. |
||||
// * integer literals without quotes. |
||||
// * boolean literals `true` and `false` without quotes. |
||||
string filter = 3; |
||||
|
||||
// The dataset to write findings' updates to. Its format is |
||||
// "projects/[project_id]/datasets/[bigquery_dataset_id]". |
||||
// BigQuery Dataset unique ID must contain only letters (a-z, A-Z), numbers |
||||
// (0-9), or underscores (_). |
||||
string dataset = 4; |
||||
|
||||
// Output only. The time at which the big query export was created. |
||||
// This field is set by the server and will be ignored if provided on export |
||||
// on creation. |
||||
google.protobuf.Timestamp create_time = 5 |
||||
[(google.api.field_behavior) = OUTPUT_ONLY]; |
||||
|
||||
// Output only. The most recent time at which the big export was updated. |
||||
// This field is set by the server and will be ignored if provided on export |
||||
// creation or update. |
||||
google.protobuf.Timestamp update_time = 6 |
||||
[(google.api.field_behavior) = OUTPUT_ONLY]; |
||||
|
||||
// Output only. Email address of the user who last edited the big query |
||||
// export. This field is set by the server and will be ignored if provided on |
||||
// export creation or update. |
||||
string most_recent_editor = 7 [(google.api.field_behavior) = OUTPUT_ONLY]; |
||||
|
||||
// Output only. The service account that needs permission to create table, |
||||
// upload data to the big query dataset. |
||||
string principal = 8 [(google.api.field_behavior) = OUTPUT_ONLY]; |
||||
} |
||||
@ -0,0 +1,190 @@ |
||||
// Copyright 2022 Google LLC |
||||
// |
||||
// Licensed under the Apache License, Version 2.0 (the "License"); |
||||
// you may not use this file except in compliance with the License. |
||||
// You may obtain a copy of the License at |
||||
// |
||||
// http://www.apache.org/licenses/LICENSE-2.0 |
||||
// |
||||
// Unless required by applicable law or agreed to in writing, software |
||||
// distributed under the License is distributed on an "AS IS" BASIS, |
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
// See the License for the specific language governing permissions and |
||||
// limitations under the License. |
||||
|
||||
syntax = "proto3"; |
||||
|
||||
package google.cloud.securitycenter.v1; |
||||
|
||||
option csharp_namespace = "Google.Cloud.SecurityCenter.V1"; |
||||
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter"; |
||||
option java_multiple_files = true; |
||||
option java_outer_classname = "MitreAttackProto"; |
||||
option java_package = "com.google.cloud.securitycenter.v1"; |
||||
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1"; |
||||
option ruby_package = "Google::Cloud::SecurityCenter::V1"; |
||||
|
||||
// MITRE ATT&CK tactics and techniques related to this finding. |
||||
// See: https://attack.mitre.org |
||||
message MitreAttack { |
||||
// MITRE ATT&CK tactics that can be referenced by SCC findings. |
||||
// See: https://attack.mitre.org/tactics/enterprise/ |
||||
enum Tactic { |
||||
// Unspecified value. |
||||
TACTIC_UNSPECIFIED = 0; |
||||
|
||||
// TA0043 |
||||
RECONNAISSANCE = 1; |
||||
|
||||
// TA0042 |
||||
RESOURCE_DEVELOPMENT = 2; |
||||
|
||||
// TA0001 |
||||
INITIAL_ACCESS = 5; |
||||
|
||||
// TA0002 |
||||
EXECUTION = 3; |
||||
|
||||
// TA0003 |
||||
PERSISTENCE = 6; |
||||
|
||||
// TA0004 |
||||
PRIVILEGE_ESCALATION = 8; |
||||
|
||||
// TA0005 |
||||
DEFENSE_EVASION = 7; |
||||
|
||||
// TA0006 |
||||
CREDENTIAL_ACCESS = 9; |
||||
|
||||
// TA0007 |
||||
DISCOVERY = 10; |
||||
|
||||
// TA0008 |
||||
LATERAL_MOVEMENT = 11; |
||||
|
||||
// TA0009 |
||||
COLLECTION = 12; |
||||
|
||||
// TA0011 |
||||
COMMAND_AND_CONTROL = 4; |
||||
|
||||
// TA0010 |
||||
EXFILTRATION = 13; |
||||
|
||||
// TA0040 |
||||
IMPACT = 14; |
||||
} |
||||
|
||||
// MITRE ATT&CK techniques that can be referenced by SCC findings. |
||||
// See: https://attack.mitre.org/techniques/enterprise/ |
||||
enum Technique { |
||||
// Unspecified value. |
||||
TECHNIQUE_UNSPECIFIED = 0; |
||||
|
||||
// T1595 |
||||
ACTIVE_SCANNING = 1; |
||||
|
||||
// T1595.001 |
||||
SCANNING_IP_BLOCKS = 2; |
||||
|
||||
// T1105 |
||||
INGRESS_TOOL_TRANSFER = 3; |
||||
|
||||
// T1106 |
||||
NATIVE_API = 4; |
||||
|
||||
// T1129 |
||||
SHARED_MODULES = 5; |
||||
|
||||
// T1059 |
||||
COMMAND_AND_SCRIPTING_INTERPRETER = 6; |
||||
|
||||
// T1059.004 |
||||
UNIX_SHELL = 7; |
||||
|
||||
// T1496 |
||||
RESOURCE_HIJACKING = 8; |
||||
|
||||
// T1090 |
||||
PROXY = 9; |
||||
|
||||
// T1090.002 |
||||
EXTERNAL_PROXY = 10; |
||||
|
||||
// T1090.003 |
||||
MULTI_HOP_PROXY = 11; |
||||
|
||||
// T1568 |
||||
DYNAMIC_RESOLUTION = 12; |
||||
|
||||
// T1552 |
||||
UNSECURED_CREDENTIALS = 13; |
||||
|
||||
// T1078 |
||||
VALID_ACCOUNTS = 14; |
||||
|
||||
// T1078.003 |
||||
LOCAL_ACCOUNTS = 15; |
||||
|
||||
// T1078.004 |
||||
CLOUD_ACCOUNTS = 16; |
||||
|
||||
// T1498 |
||||
NETWORK_DENIAL_OF_SERVICE = 17; |
||||
|
||||
// T1069 |
||||
PERMISSION_GROUPS_DISCOVERY = 18; |
||||
|
||||
// T1069.003 |
||||
CLOUD_GROUPS = 19; |
||||
|
||||
// T1567 |
||||
EXFILTRATION_OVER_WEB_SERVICE = 20; |
||||
|
||||
// T1567.002 |
||||
EXFILTRATION_TO_CLOUD_STORAGE = 21; |
||||
|
||||
// T1098 |
||||
ACCOUNT_MANIPULATION = 22; |
||||
|
||||
// T1098.004 |
||||
SSH_AUTHORIZED_KEYS = 23; |
||||
|
||||
// T1543 |
||||
CREATE_OR_MODIFY_SYSTEM_PROCESS = 24; |
||||
|
||||
// T1539 |
||||
STEAL_WEB_SESSION_COOKIE = 25; |
||||
|
||||
// T1578 |
||||
MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE = 26; |
||||
|
||||
// T1190 |
||||
EXPLOIT_PUBLIC_FACING_APPLICATION = 27; |
||||
|
||||
// T1556 |
||||
MODIFY_AUTHENTICATION_PROCESS = 28; |
||||
} |
||||
|
||||
// The MITRE ATT&CK tactic most closely represented by this finding, if any. |
||||
Tactic primary_tactic = 1; |
||||
|
||||
// The MITRE ATT&CK technique most closely represented by this finding, if |
||||
// any. primary_techniques is a repeated field because there are multiple |
||||
// levels of MITRE ATT&CK techniques. If the technique most closely |
||||
// represented by this finding is a sub-technique (e.g. `SCANNING_IP_BLOCKS`), |
||||
// both the sub-technique and its parent technique(s) will be listed (e.g. |
||||
// `SCANNING_IP_BLOCKS`, `ACTIVE_SCANNING`). |
||||
repeated Technique primary_techniques = 2; |
||||
|
||||
// Additional MITRE ATT&CK tactics related to this finding, if any. |
||||
repeated Tactic additional_tactics = 3; |
||||
|
||||
// Additional MITRE ATT&CK techniques related to this finding, if any, along |
||||
// with any of their respective parent techniques. |
||||
repeated Technique additional_techniques = 4; |
||||
|
||||
// The MITRE ATT&CK version referenced by the above fields. E.g. "8". |
||||
string version = 5; |
||||
} |
||||
Loading…
Reference in new issue