Skip to content

Commit 5f6048b

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Support Chokepoint and external exposure in findings Proto
PiperOrigin-RevId: 884685891
1 parent 97ee714 commit 5f6048b

File tree

6 files changed

+199
-3
lines changed

6 files changed

+199
-3
lines changed

‎google/cloud/securitycenter/v1/BUILD.bazel‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ proto_library(
3131
"attack_path.proto",
3232
"backup_disaster_recovery.proto",
3333
"bigquery_export.proto",
34+
"chokepoint.proto",
3435
"cloud_armor.proto",
3536
"cloud_dlp_data_profile.proto",
3637
"cloud_dlp_inspection.proto",
@@ -44,6 +45,7 @@ proto_library(
4445
"event_threat_detection_custom_module.proto",
4546
"event_threat_detection_custom_module_validation_errors.proto",
4647
"exfiltration.proto",
48+
"external_exposure.proto",
4749
"external_system.proto",
4850
"file.proto",
4951
"finding.proto",
@@ -82,6 +84,7 @@ proto_library(
8284
"//google/api:annotations_proto",
8385
"//google/api:client_proto",
8486
"//google/api:field_behavior_proto",
87+
"//google/api:field_info_proto",
8588
"//google/api:resource_proto",
8689
"//google/iam/v1:iam_policy_proto",
8790
"//google/iam/v1:policy_proto",
@@ -405,6 +408,7 @@ load(
405408

406409
csharp_proto_library(
407410
name = "securitycenter_csharp_proto",
411+
extra_opts = [],
408412
deps = [":securitycenter_proto"],
409413
)
410414

‎google/cloud/securitycenter/v1/chokepoint.proto‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Copyright 2026 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
20+
option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
21+
option java_multiple_files = true;
22+
option java_outer_classname = "ChokepointProto";
23+
option java_package = "com.google.cloud.securitycenter.v1";
24+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
25+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
26+
27+
// Contains details about a chokepoint, which is a resource or resource group
28+
// where high-risk attack paths converge, based on [attack path simulations]
29+
// (https://cloud.google.com/security-command-center/docs/attack-exposure-learn#attack_path_simulations).
30+
message Chokepoint {
31+
// List of resource names of findings associated with this chokepoint.
32+
// For example, organizations/123/sources/456/findings/789.
33+
// This list will have at most 100 findings.
34+
repeated string related_findings = 1;
35+
}

‎google/cloud/securitycenter/v1/cloud_dlp_data_profile.proto‎

Lines changed: 57 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -54,4 +54,60 @@ message CloudDlpDataProfile {
5454

5555
// The resource hierarchy level at which the data profile was generated.
5656
ParentType parent_type = 2;
57+
58+
// Type of information detected by SDP.
59+
// Info type includes name, version and sensitivity of the detected
60+
// information type.
61+
repeated InfoType info_types = 3;
62+
}
63+
64+
// Type of information detected by the API.
65+
message InfoType {
66+
// Name of the information type. Either a name of your choosing when
67+
// creating a CustomInfoType, or one of the names listed
68+
// at
69+
// https://cloud.google.com/sensitive-data-protection/docs/infotypes-reference
70+
// when specifying a built-in type. When sending Cloud DLP results to Data
71+
// Catalog, infoType names should conform to the pattern
72+
// `[A-Za-z0-9$_-]{1,64}`.
73+
string name = 1;
74+
75+
// Optional version name for this InfoType.
76+
string version = 2;
77+
78+
// Optional custom sensitivity for this InfoType.
79+
// This only applies to data profiling.
80+
SensitivityScore sensitivity_score = 3;
81+
}
82+
83+
// Score is calculated from of all elements in the data profile.
84+
// A higher level means the data is more sensitive.
85+
message SensitivityScore {
86+
// Various sensitivity score levels for resources.
87+
enum SensitivityScoreLevel {
88+
// Unused.
89+
SENSITIVITY_SCORE_LEVEL_UNSPECIFIED = 0;
90+
91+
// No sensitive information detected. The resource isn't publicly
92+
// accessible.
93+
SENSITIVITY_LOW = 10;
94+
95+
// Unable to determine sensitivity.
96+
SENSITIVITY_UNKNOWN = 12;
97+
98+
// Medium risk. Contains personally identifiable information (PII),
99+
// potentially sensitive data, or fields with free-text data that are at a
100+
// higher risk of having intermittent sensitive data. Consider limiting
101+
// access.
102+
SENSITIVITY_MODERATE = 20;
103+
104+
// High risk. Sensitive personally identifiable information (SPII) can be
105+
// present. Exfiltration of data can lead to user data loss.
106+
// Re-identification of users might be possible. Consider limiting usage and
107+
// or removing SPII.
108+
SENSITIVITY_HIGH = 30;
109+
}
110+
111+
// The sensitivity score applied to the resource.
112+
SensitivityScoreLevel score = 1;
57113
}

‎google/cloud/securitycenter/v1/external_exposure.proto‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
// Copyright 2026 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.securitycenter.v1;
18+
19+
import "google/api/field_info.proto";
20+
21+
option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
22+
option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
23+
option java_multiple_files = true;
24+
option java_outer_classname = "ExternalExposureProto";
25+
option java_package = "com.google.cloud.securitycenter.v1";
26+
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
27+
option ruby_package = "Google::Cloud::SecurityCenter::V1";
28+
29+
// Details about the externally exposed resource associated with the finding.
30+
message ExternalExposure {
31+
// Private IP address of the exposed endpoint.
32+
string private_ip_address = 1 [(google.api.field_info).format = IPV4_OR_IPV6];
33+
34+
// Port number associated with private IP address.
35+
string private_port = 2;
36+
37+
// The name and version of the service, for example, "Jupyter
38+
// Notebook 6.14.0".
39+
string exposed_service = 3;
40+
41+
// Public IP address of the exposed endpoint.
42+
string public_ip_address = 4 [(google.api.field_info).format = IPV4_OR_IPV6];
43+
44+
// Public port number of the exposed endpoint.
45+
string public_port = 5;
46+
47+
// The resource which is running the exposed service, for example,
48+
// "//compute.googleapis.com/projects/{project-id}/zones/{zone}/instances/{instance}.”
49+
string exposed_endpoint = 6;
50+
51+
// The full resource name of the load balancer firewall policy, for example,
52+
// "//compute.googleapis.com/projects/{project-id}/global/firewallPolicies/{policy-name}".
53+
string load_balancer_firewall_policy = 7;
54+
55+
// The full resource name of the firewall policy of the exposed service, for
56+
// example,
57+
// "//compute.googleapis.com/projects/{project-id}/global/firewallPolicies/{policy-name}".
58+
string service_firewall_policy = 8;
59+
60+
// The full resource name of the forwarding rule, for example,
61+
// "//compute.googleapis.com/projects/{project-id}/global/forwardingRules/{forwarding-rule-name}".
62+
string forwarding_rule = 9;
63+
64+
// The full resource name of load balancer backend service, for example,
65+
// "//compute.googleapis.com/projects/{project-id}/global/backendServices/{name}".
66+
string backend_service = 10;
67+
68+
// The full resource name of the instance group, for example,
69+
// "//compute.googleapis.com/projects/{project-id}/global/instanceGroups/{name}".
70+
string instance_group = 11;
71+
72+
// The full resource name of the network endpoint group, for example,
73+
// "//compute.googleapis.com/projects/{project-id}/global/networkEndpointGroups/{name}".
74+
string network_endpoint_group = 12;
75+
}

‎google/cloud/securitycenter/v1/finding.proto‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -22,6 +22,7 @@ import "google/cloud/securitycenter/v1/access.proto";
2222
import "google/cloud/securitycenter/v1/application.proto";
2323
import "google/cloud/securitycenter/v1/attack_exposure.proto";
2424
import "google/cloud/securitycenter/v1/backup_disaster_recovery.proto";
25+
import "google/cloud/securitycenter/v1/chokepoint.proto";
2526
import "google/cloud/securitycenter/v1/cloud_armor.proto";
2627
import "google/cloud/securitycenter/v1/cloud_dlp_data_profile.proto";
2728
import "google/cloud/securitycenter/v1/cloud_dlp_inspection.proto";
@@ -31,6 +32,7 @@ import "google/cloud/securitycenter/v1/contact_details.proto";
3132
import "google/cloud/securitycenter/v1/container.proto";
3233
import "google/cloud/securitycenter/v1/database.proto";
3334
import "google/cloud/securitycenter/v1/exfiltration.proto";
35+
import "google/cloud/securitycenter/v1/external_exposure.proto";
3436
import "google/cloud/securitycenter/v1/external_system.proto";
3537
import "google/cloud/securitycenter/v1/file.proto";
3638
import "google/cloud/securitycenter/v1/group_membership.proto";
@@ -194,6 +196,18 @@ message Finding {
194196
// independently. A group of such issues is referred to as a toxic
195197
// combination.
196198
TOXIC_COMBINATION = 7;
199+
200+
// Describes a potential security risk to data assets that contain sensitive
201+
// data.
202+
SENSITIVE_DATA_RISK = 8;
203+
204+
// Describes a resource or resource group where high risk attack paths
205+
// converge, based on attack path simulations (APS).
206+
CHOKEPOINT = 9;
207+
208+
// Describes a potential security risk due to the resource being exposed to
209+
// the internet.
210+
EXTERNAL_EXPOSURE = 10;
197211
}
198212

199213
// Mute information about the finding, including whether the finding has a
@@ -459,4 +473,13 @@ message Finding {
459473
// a collection of findings that are related in some way.
460474
// This field cannot be updated. Its value is ignored in all update requests.
461475
repeated GroupMembership group_memberships = 65;
476+
477+
// Contains details about a chokepoint, which is a resource or resource group
478+
// where high-risk attack paths converge, based on [attack path simulations]
479+
// (https://cloud.google.com/security-command-center/docs/attack-exposure-learn#attack_path_simulations).
480+
// This field cannot be updated. Its value is ignored in all update requests.
481+
Chokepoint chokepoint = 77;
482+
483+
// External exposure associated with the finding.
484+
ExternalExposure external_exposure = 84;
462485
}

‎google/cloud/securitycenter/v1/group_membership.proto‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -34,6 +34,9 @@ message GroupMembership {
3434

3535
// Group represents a toxic combination.
3636
GROUP_TYPE_TOXIC_COMBINATION = 1;
37+
38+
// Group represents a chokepoint.
39+
GROUP_TYPE_CHOKEPOINT = 3;
3740
}
3841

3942
// Type of group.

0 commit comments

Comments
 (0)