Skip to content

Commit d5b9d24

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: Added container field to findings attributes (#499)
* feat: Added container field to findings attributes feat: Added kubernetes field to findings attribute. This field is populated only when the container is a kubernetes cluster explicitly PiperOrigin-RevId: 462248767 Source-Link: googleapis/googleapis@dd2b0d2 Source-Link: googleapis/googleapis-gen@0be13cf Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiMGJlMTNjZjUzY2E0NTU1NTQ4OWQ3MzQxOWQxMDUzYTcwOWE4ZGVjZCJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent f7aa3b1 commit d5b9d24

File tree

9 files changed

+7194
-2751
lines changed

9 files changed

+7194
-2751
lines changed

‎packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/container.proto

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/cloud/securitycenter/v1/label.proto";
20+
21+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
22+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
23+
option java_multiple_files = true;
24+
option java_outer_classname = "ContainerProto";
25+
option java_package = "com.google.cloud.securitycenter.v1";
26+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
27+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
28+
29+
// Container associated with the finding.
30+
message Container {
31+
// Container name.
32+
string name = 1;
33+
34+
// Container image URI provided when configuring a pod/container.
35+
// May identify a container image version using mutable tags.
36+
string uri = 2;
37+
38+
// Optional container image id, when provided by the container runtime.
39+
// Uniquely identifies the container image launched using a container image
40+
// digest.
41+
string image_id = 3;
42+
43+
// Container labels, as provided by the container runtime.
44+
repeated Label labels = 4;
45+
}

‎packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/finding.proto

+9
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,12 @@ import "google/cloud/securitycenter/v1/access.proto";
2222
import "google/cloud/securitycenter/v1/compliance.proto";
2323
import "google/cloud/securitycenter/v1/connection.proto";
2424
import "google/cloud/securitycenter/v1/contact_details.proto";
25+
import "google/cloud/securitycenter/v1/container.proto";
2526
import "google/cloud/securitycenter/v1/exfiltration.proto";
2627
import "google/cloud/securitycenter/v1/external_system.proto";
2728
import "google/cloud/securitycenter/v1/iam_binding.proto";
2829
import "google/cloud/securitycenter/v1/indicator.proto";
30+
import "google/cloud/securitycenter/v1/kubernetes.proto";
2931
import "google/cloud/securitycenter/v1/mitre_attack.proto";
3032
import "google/cloud/securitycenter/v1/process.proto";
3133
import "google/cloud/securitycenter/v1/security_marks.proto";
@@ -315,4 +317,11 @@ message Finding {
315317

316318
// Next steps associate to the finding.
317319
string next_steps = 40;
320+
321+
// Containers associated with the finding. containers provides information
322+
// for both Kubernetes and non-Kubernetes containers.
323+
repeated Container containers = 42;
324+
325+
// Kubernetes resources associated with the finding.
326+
Kubernetes kubernetes = 43;
318327
}

‎packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/kubernetes.proto

+181
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/cloud/securitycenter/v1/container.proto";
20+
import "google/cloud/securitycenter/v1/label.proto";
21+
22+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
23+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
24+
option java_multiple_files = true;
25+
option java_outer_classname = "KubernetesProto";
26+
option java_package = "com.google.cloud.securitycenter.v1";
27+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
28+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
29+
30+
// Kubernetes related attributes.
31+
message Kubernetes {
32+
// Kubernetes Pod.
33+
message Pod {
34+
// Kubernetes Pod namespace.
35+
string ns = 1;
36+
37+
// Kubernetes Pod name.
38+
string name = 2;
39+
40+
// Pod labels. For Kubernetes containers, these are applied to the
41+
// container.
42+
repeated Label labels = 3;
43+
44+
// Pod containers associated with this finding, if any.
45+
repeated Container containers = 4;
46+
}
47+
48+
// Kubernetes Nodes associated with the finding.
49+
message Node {
50+
// Full Resource name of the Compute Engine VM running the
51+
// cluster node.
52+
string name = 1;
53+
}
54+
55+
// Provides GKE Node Pool information.
56+
message NodePool {
57+
// Kubernetes Node pool name.
58+
string name = 1;
59+
60+
// Nodes associated with the finding.
61+
repeated Node nodes = 2;
62+
}
63+
64+
// Kubernetes Role or ClusterRole.
65+
message Role {
66+
// Types of Kubernetes roles.
67+
enum Kind {
68+
// Role type is not specified.
69+
KIND_UNSPECIFIED = 0;
70+
71+
// Kubernetes Role.
72+
ROLE = 1;
73+
74+
// Kubernetes ClusterRole.
75+
CLUSTER_ROLE = 2;
76+
}
77+
78+
// Role type.
79+
Kind kind = 1;
80+
81+
// Role namespace.
82+
string ns = 2;
83+
84+
// Role name.
85+
string name = 3;
86+
}
87+
88+
// Represents a Kubernetes RoleBinding or ClusterRoleBinding.
89+
message Binding {
90+
// Namespace for binding.
91+
string ns = 1;
92+
93+
// Name for binding.
94+
string name = 2;
95+
96+
// The Role or ClusterRole referenced by the binding.
97+
Role role = 3;
98+
99+
// Represents the subjects(s) bound to the role. Not always available
100+
// for PATCH requests.
101+
repeated Subject subjects = 4;
102+
}
103+
104+
// Represents a Kubernetes Subject.
105+
message Subject {
106+
// Auth types that can be used for Subject's kind field.
107+
enum AuthType {
108+
// Authentication is not specified.
109+
AUTH_TYPE_UNSPECIFIED = 0;
110+
111+
// User with valid certificate.
112+
USER = 1;
113+
114+
// Users managed by Kubernetes API with credentials stored as Secrets.
115+
SERVICEACCOUNT = 2;
116+
117+
// Collection of users.
118+
GROUP = 3;
119+
}
120+
121+
// Authentication type for subject.
122+
AuthType kind = 1;
123+
124+
// Namespace for subject.
125+
string ns = 2;
126+
127+
// Name for subject.
128+
string name = 3;
129+
}
130+
131+
// Conveys information about a Kubernetes access review (e.g. kubectl auth
132+
// can-i ...) that was involved in a finding.
133+
message AccessReview {
134+
// Group is the API Group of the Resource. "*" means all.
135+
string group = 1;
136+
137+
// Namespace of the action being requested. Currently, there is no
138+
// distinction between no namespace and all namespaces. Both
139+
// are represented by "" (empty).
140+
string ns = 2;
141+
142+
// Name is the name of the resource being requested. Empty means all.
143+
string name = 3;
144+
145+
// Resource is the optional resource type requested. "*" means all.
146+
string resource = 4;
147+
148+
// Subresource is the optional subresource type.
149+
string subresource = 5;
150+
151+
// Verb is a Kubernetes resource API verb, like: get, list, watch, create,
152+
// update, delete, proxy. "*" means all.
153+
string verb = 6;
154+
155+
// Version is the API Version of the Resource. "*" means all.
156+
string version = 7;
157+
}
158+
159+
// Kubernetes Pods associated with the finding. This field will contain Pod
160+
// records for each container that is owned by a Pod.
161+
repeated Pod pods = 1;
162+
163+
// Provides Kubernetes Node information.
164+
repeated Node nodes = 2;
165+
166+
// GKE Node Pools associated with the finding. This field will
167+
// contain NodePool information for each Node, when it is available.
168+
repeated NodePool node_pools = 3;
169+
170+
// Provides Kubernetes role information for findings that involve
171+
// Roles or ClusterRoles.
172+
repeated Role roles = 4;
173+
174+
// Provides Kubernetes role binding information for findings that involve
175+
// RoleBindings or ClusterRoleBindings.
176+
repeated Binding bindings = 5;
177+
178+
// Provides information on any Kubernetes access reviews (i.e. privilege
179+
// checks) relevant to the finding.
180+
repeated AccessReview access_reviews = 6;
181+
}

‎packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/label.proto

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Copyright 2022 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
20+
option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
21+
option java_multiple_files = true;
22+
option java_outer_classname = "LabelProto";
23+
option java_package = "com.google.cloud.securitycenter.v1";
24+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
25+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
26+
27+
// Label represents a generic name=value label. Label has separate name and
28+
// value fields to support filtering with contains().
29+
message Label {
30+
// Label name.
31+
string name = 1;
32+
33+
// Label value.
34+
string value = 2;
35+
}

‎packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/mitre_attack.proto

+3
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,9 @@ message MitreAttack {
174174

175175
// T1562
176176
IMPAIR_DEFENSES = 31;
177+
178+
// T1046
179+
NETWORK_SERVICE_DISCOVERY = 32;
177180
}
178181

179182
// The MITRE ATT&CK tactic most closely represented by this finding, if any.

0 commit comments

Comments
 (0)