findings

Creates, updates, deletes, gets or lists a findings resource.

Overview

Name	findings
Type	Resource
Id	google.threatintelligence.findings

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
name	string	Identifier. Server generated name for the finding (leave clear during creation). Format: projects/{project}/findings/{finding}
aiSummary	string	Optional. AI summary of the finding.
alert	string	Optional. Name of the alert that this finding is bound to.
audit	object	Output only. Audit data about the finding. (id: Audit)
configurations	array	Optional. Configuration names that are bound to this finding.
detail	object	Required. Holder of the domain specific details of the finding. (id: FindingDetail)
displayName	string	Required. A short descriptive title for the finding <= 250 chars. EX: "Actor 'baddy' offering $1000 for credentials of 'goodguy'".
provider	string	Required. Logical source of this finding (name of the sub-engine).
relevanceAnalysis	object	Output only. High-Precision Relevance Analysis verdict for the finding. (id: RelevanceAnalysis)
reoccurrenceTimes	array	Output only. When identical finding (same labels and same details) has re-occurred.
severity	number (float)	Optional. Deprecated: Use the severity_analysis field instead. Base severity score from the finding source.
severityAnalysis	object	Output only. High-Precision Severity Analysis verdict for the finding. (id: SeverityAnalysis)

list

Name	Datatype	Description
name	string	Identifier. Server generated name for the finding (leave clear during creation). Format: projects/{project}/findings/{finding}
aiSummary	string	Optional. AI summary of the finding.
alert	string	Optional. Name of the alert that this finding is bound to.
audit	object	Output only. Audit data about the finding. (id: Audit)
configurations	array	Optional. Configuration names that are bound to this finding.
detail	object	Required. Holder of the domain specific details of the finding. (id: FindingDetail)
displayName	string	Required. A short descriptive title for the finding <= 250 chars. EX: "Actor 'baddy' offering $1000 for credentials of 'goodguy'".
provider	string	Required. Logical source of this finding (name of the sub-engine).
relevanceAnalysis	object	Output only. High-Precision Relevance Analysis verdict for the finding. (id: RelevanceAnalysis)
reoccurrenceTimes	array	Output only. When identical finding (same labels and same details) has re-occurred.
severity	number (float)	Optional. Deprecated: Use the severity_analysis field instead. Base severity score from the finding source.
severityAnalysis	object	Output only. High-Precision Severity Analysis verdict for the finding. (id: SeverityAnalysis)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	projectsId, findingsId		Get a finding by name. The name field should have the format: projects/{project}/findings/{finding}
list	select	projectsId	pageToken, pageSize, filter, orderBy	Get a list of findings that meet the filter criteria. The parent field in ListFindingsRequest should have the format: projects/{project}
search	exec	projectsId	orderBy, pageToken, pageSize, query	SearchFindings is a more powerful version of ListFindings that supports complex queries like "findings for alerts" using functions such as has_alert in the query string. The parent field in SearchFindingsRequest should have the format: projects/{project} Example to search for findings for a specific issue: has_alert("name=\"projects/gti-12345/alerts/alert-12345\"")

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
findingsId	string
projectsId	string
filter	string
orderBy	string
pageSize	integer (int32)
pageToken	string
query	string

SELECT examples

get

Get a finding by name. The name field should have the format: projects/{project}/findings/{finding}

SELECT
name,
aiSummary,
alert,
audit,
configurations,
detail,
displayName,
provider,
relevanceAnalysis,
reoccurrenceTimes,
severity,
severityAnalysis
FROM google.threatintelligence.findings
WHERE projectsId = '{{ projectsId }}' -- required
AND findingsId = '{{ findingsId }}' -- required
;

list

Get a list of findings that meet the filter criteria. The parent field in ListFindingsRequest should have the format: projects/{project}

SELECT
name,
aiSummary,
alert,
audit,
configurations,
detail,
displayName,
provider,
relevanceAnalysis,
reoccurrenceTimes,
severity,
severityAnalysis
FROM google.threatintelligence.findings
WHERE projectsId = '{{ projectsId }}' -- required
AND pageToken = '{{ pageToken }}'
AND pageSize = '{{ pageSize }}'
AND filter = '{{ filter }}'
AND orderBy = '{{ orderBy }}'
;

Lifecycle Methods

search

SearchFindings is a more powerful version of ListFindings that supports complex queries like "findings for alerts" using functions such as has_alert in the query string. The parent field in SearchFindingsRequest should have the format: projects/{project} Example to search for findings for a specific issue: has_alert("name=\"projects/gti-12345/alerts/alert-12345\"")

EXEC google.threatintelligence.findings.search 
@projectsId='{{ projectsId }}' --required, 
@orderBy='{{ orderBy }}', 
@pageToken='{{ pageToken }}', 
@pageSize='{{ pageSize }}', 
@query='{{ query }}'
;