feat: [securitycenter] added cloud provider field to list findings re…

…sponse (googleapis#5529)

* feat: added cloud provider field to list findings response
feat: added ResourceValueConfig protos and API methods
feat: added etd custom module protos and API methods
feat: added toxic combination field to finding
feat: added attack path API methods
docs: update toxic combinations comments
docs: update examples in comments to use backticks

PiperOrigin-RevId: 650374217

Source-Link: googleapis/googleapis@f6b7b34

Source-Link: https://github.com/googleapis/googleapis-gen/commit/7379e7c4493b24d64fc43384e0566ccb8e1ffeff
Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLXNlY3VyaXR5Y2VudGVyLy5Pd2xCb3QueWFtbCIsImgiOiI3Mzc5ZTdjNDQ5M2IyNGQ2NGZjNDMzODRlMDU2NmNjYjhlMWZmZWZmIn0=

* 🦉 Updates from OwlBot post-processor

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

---------

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/asset.proto

@@ -42,6 +42,8 @@ message Asset {
     pattern: "organizations/{organization}/assets/{asset}"
     pattern: "folders/{folder}/assets/{asset}"
     pattern: "projects/{project}/assets/{asset}"
+    plural: "assets"
+    singular: "asset"
   };
 
   // Security Command Center managed properties. These properties are managed by

packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/attack_exposure.proto

@@ -0,0 +1,71 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v1;
+
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
+option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
+option java_multiple_files = true;
+option java_outer_classname = "AttackExposureProto";
+option java_package = "com.google.cloud.securitycenter.v1";
+option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
+option ruby_package = "Google::Cloud::SecurityCenter::V1";
+
+// An attack exposure contains the results of an attack path simulation run.
+message AttackExposure {
+  // This enum defines the various states an AttackExposure can be in.
+  enum State {
+    // The state is not specified.
+    STATE_UNSPECIFIED = 0;
+
+    // The attack exposure has been calculated.
+    CALCULATED = 1;
+
+    // The attack exposure has not been calculated.
+    NOT_CALCULATED = 2;
+  }
+
+  // A number between 0 (inclusive) and infinity that represents how important
+  // this finding is to remediate. The higher the score, the more important it
+  // is to remediate.
+  double score = 1;
+
+  // The most recent time the attack exposure was updated on this finding.
+  google.protobuf.Timestamp latest_calculation_time = 2;
+
+  // The resource name of the attack path simulation result that contains the
+  // details regarding this attack exposure score.
+  // Example: `organizations/123/simulations/456/attackExposureResults/789`
+  string attack_exposure_result = 3;
+
+  // What state this AttackExposure is in. This captures whether or not an
+  // attack exposure has been calculated or not.
+  State state = 4;
+
+  // The number of high value resources that are exposed as a result of this
+  // finding.
+  int32 exposed_high_value_resources_count = 5;
+
+  // The number of medium value resources that are exposed as a result of this
+  // finding.
+  int32 exposed_medium_value_resources_count = 6;
+
+  // The number of high value resources that are exposed as a result of this
+  // finding.
+  int32 exposed_low_value_resources_count = 7;
+}

packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/attack_path.proto

@@ -0,0 +1,131 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v1;
+
+import "google/api/resource.proto";
+
+option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
+option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
+option java_multiple_files = true;
+option java_outer_classname = "AttackPathProto";
+option java_package = "com.google.cloud.securitycenter.v1";
+option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
+option ruby_package = "Google::Cloud::SecurityCenter::V1";
+
+// A path that an attacker could take to reach an exposed resource.
+message AttackPath {
+  option (google.api.resource) = {
+    type: "securitycenter.googleapis.com/AttackPath"
+    pattern: "organizations/{organization}/simulations/{simulation}/valuedResources/{valued_resource}/attackPaths/{attack_path}"
+    plural: "attackPaths"
+    singular: "attackPath"
+  };
+
+  // Represents one point that an attacker passes through in this attack path.
+  message AttackPathNode {
+    // A finding that is associated with this node in the attack path.
+    message PathNodeAssociatedFinding {
+      // Canonical name of the associated findings. Example:
+      // `organizations/123/sources/456/findings/789`
+      string canonical_finding = 1;
+
+      // The additional taxonomy group within findings from a given source.
+      string finding_category = 2;
+
+      // Full resource name of the finding.
+      string name = 3;
+    }
+
+    // The type of the incoming attack step node.
+    enum NodeType {
+      // Type not specified
+      NODE_TYPE_UNSPECIFIED = 0;
+
+      // Incoming edge joined with AND
+      NODE_TYPE_AND = 1;
+
+      // Incoming edge joined with OR
+      NODE_TYPE_OR = 2;
+
+      // Incoming edge is defense
+      NODE_TYPE_DEFENSE = 3;
+
+      // Incoming edge is attacker
+      NODE_TYPE_ATTACKER = 4;
+    }
+
+    // Detailed steps the attack can take between path nodes.
+    message AttackStepNode {
+      // Unique ID for one Node
+      string uuid = 1;
+
+      // Attack step type. Can be either AND, OR or DEFENSE
+      NodeType type = 2;
+
+      // User friendly name of the attack step
+      string display_name = 3;
+
+      // Attack step labels for metadata
+      map<string, string> labels = 4;
+
+      // Attack step description
+      string description = 5;
+    }
+
+    // The name of the resource at this point in the attack path.
+    // The format of the name follows the Cloud Asset Inventory [resource
+    // name
+    // format](https://cloud.google.com/asset-inventory/docs/resource-name-format)
+    string resource = 1;
+
+    // The [supported resource
+    // type](https://cloud.google.com/asset-inventory/docs/supported-asset-types)
+    string resource_type = 2;
+
+    // Human-readable name of this resource.
+    string display_name = 3;
+
+    // The findings associated with this node in the attack path.
+    repeated PathNodeAssociatedFinding associated_findings = 4;
+
+    // Unique id of the attack path node.
+    string uuid = 5;
+
+    // A list of attack step nodes that exist in this attack path node.
+    repeated AttackStepNode attack_steps = 6;
+  }
+
+  // Represents a connection between a source node and a destination node in
+  // this attack path.
+  message AttackPathEdge {
+    // The attack node uuid of the source node.
+    string source = 1;
+
+    // The attack node uuid of the destination node.
+    string destination = 2;
+  }
+
+  // The attack path name, for example,
+  //  `organizations/12/simulation/34/valuedResources/56/attackPaths/78`
+  string name = 1;
+
+  // A list of nodes that exist in this attack path.
+  repeated AttackPathNode path_nodes = 2;
+
+  // A list of the edges between nodes in this attack path.
+  repeated AttackPathEdge edges = 3;
+}

packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/bigquery_export.proto

@@ -35,6 +35,8 @@ message BigQueryExport {
     pattern: "organizations/{organization}/bigQueryExports/{export}"
     pattern: "folders/{folder}/bigQueryExports/{export}"
     pattern: "projects/{project}/bigQueryExports/{export}"
+    plural: "bigQueryExports"
+    singular: "bigQueryExport"
   };
 
   // The relative resource name of this export. See:

packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/cloud_armor.proto

@@ -47,8 +47,8 @@ message CloudArmor {
   Attack attack = 4;
 
   // Distinguish between volumetric & protocol DDoS attack and
-  // application layer attacks. For example, “L3_4” for Layer 3 and Layer 4 DDoS
-  // attacks, or “L_7” for Layer 7 DDoS attacks.
+  // application layer attacks. For example, "L3_4" for Layer 3 and Layer 4 DDoS
+  // attacks, or "L_7" for Layer 7 DDoS attacks.
   string threat_vector = 5;
 
   // Duration of attack from the start until the current moment (updated every 5
@@ -64,9 +64,9 @@ message SecurityPolicy {
   // "my-security-policy".
   string name = 1;
 
-  // The type of Google Cloud Armor security policy for example, ‘backend
-  // security policy’, ‘edge security policy’, ‘network edge security policy’,
-  // or ‘always-on DDoS protection’.
+  // The type of Google Cloud Armor security policy for example, 'backend
+  // security policy', 'edge security policy', 'network edge security policy',
+  // or 'always-on DDoS protection'.
   string type = 2;
 
   // Whether or not the associated rule or policy is in preview mode.
@@ -109,6 +109,6 @@ message Attack {
   // Total BPS (bytes per second) volume of attack.
   int32 volume_bps = 2;
 
-  // Type of attack, for example, ‘SYN-flood’, ‘NTP-udp’, or ‘CHARGEN-udp’.
+  // Type of attack, for example, 'SYN-flood', 'NTP-udp', or 'CHARGEN-udp'.
   string classification = 3;
 }

packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/effective_event_threat_detection_custom_module.proto

@@ -0,0 +1,85 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v1;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/struct.proto";
+
+option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
+option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
+option java_multiple_files = true;
+option java_outer_classname = "EffectiveEventThreatDetectionCustomModuleProto";
+option java_package = "com.google.cloud.securitycenter.v1";
+option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
+option ruby_package = "Google::Cloud::SecurityCenter::V1";
+
+// An EffectiveEventThreatDetectionCustomModule is the representation of
+// an Event Threat Detection custom module at a specified level of the
+// resource hierarchy: organization, folder, or project. If a custom module is
+// inherited from a parent organization or folder, the value of the
+// `enablement_state` property in EffectiveEventThreatDetectionCustomModule is
+// set to the value that is effective in the parent, instead of `INHERITED`.
+// For example, if the module is enabled in a parent organization or folder, the
+// effective `enablement_state` for the module in all child folders or projects
+// is also `enabled`. EffectiveEventThreatDetectionCustomModule is read-only.
+message EffectiveEventThreatDetectionCustomModule {
+  option (google.api.resource) = {
+    type: "securitycenter.googleapis.com/EffectiveEventThreatDetectionCustomModule"
+    pattern: "organizations/{organization}/eventThreatDetectionSettings/effectiveCustomModules/{module}"
+    pattern: "folders/{folder}/eventThreatDetectionSettings/effectiveCustomModules/{module}"
+    pattern: "projects/{project}/eventThreatDetectionSettings/effectiveCustomModules/{module}"
+  };
+
+  // The enablement state of the module.
+  enum EnablementState {
+    // Unspecified enablement state.
+    ENABLEMENT_STATE_UNSPECIFIED = 0;
+
+    // The module is enabled at the given level.
+    ENABLED = 1;
+
+    // The module is disabled at the given level.
+    DISABLED = 2;
+  }
+
+  // Output only. The resource name of the effective ETD custom module.
+  //
+  // Its format is:
+  //
+  //   * `organizations/{organization}/eventThreatDetectionSettings/effectiveCustomModules/{module}`.
+  //   * `folders/{folder}/eventThreatDetectionSettings/effectiveCustomModules/{module}`.
+  //   * `projects/{project}/eventThreatDetectionSettings/effectiveCustomModules/{module}`.
+  string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Config for the effective module.
+  google.protobuf.Struct config = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The effective state of enablement for the module at the given
+  // level of the hierarchy.
+  EnablementState enablement_state = 3
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Type for the module. e.g. CONFIGURABLE_BAD_IP.
+  string type = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The human readable name to be displayed for the module.
+  string display_name = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The description for the module.
+  string description = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+}