Skip to content

Commit 5d35c16

Browse files
vijaykanthmsubfuziongrayside
authored
feat(security-center): Add Resource v2 API Security Marks Samples (#3835)
* Add Resource v2 security marks samples * feat(security marks): Add Resource v2 API Security Marks Samples * remove mentioning the v2 path from workflows * Address Suggestions * fix lint error * Address suggestions * fix lint error --------- Co-authored-by: Tony Pujals <[email protected]> Co-authored-by: Adam Ross <[email protected]>
1 parent b217430 commit 5d35c16

File tree

5 files changed

+383
-0
lines changed

5 files changed

+383
-0
lines changed

‎security-center/snippets/system-test/v2/securityMarks.test.js

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
// Copyright 2024 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// https://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
'use strict';
16+
17+
const {SecurityCenterClient} = require('@google-cloud/security-center').v2;
18+
const {assert} = require('chai');
19+
const {describe, it, before} = require('mocha');
20+
const {execSync} = require('child_process');
21+
const exec = cmd => execSync(cmd, {encoding: 'utf8'});
22+
23+
const organizationId = process.env.GCLOUD_ORGANIZATION;
24+
25+
describe('Client with SourcesAndFindings', async () => {
26+
let data;
27+
before(async () => {
28+
// Creates a new client.
29+
const client = new SecurityCenterClient();
30+
const [source] = await client
31+
.createSource({
32+
source: {
33+
displayName: 'Customized Display Name',
34+
description: 'A new custom source that does X',
35+
},
36+
parent: client.organizationPath(organizationId),
37+
})
38+
.catch(error => console.error(error));
39+
const eventTime = new Date();
40+
const createFindingTemplate = {
41+
parent: source.name,
42+
findingId: 'somefinding',
43+
finding: {
44+
state: 'ACTIVE',
45+
// Resource the finding is associated with. This is an
46+
// example any resource identifier can be used.
47+
resourceName: `//cloudresourcemanager.googleapis.com/organizations/${organizationId}`,
48+
// A free-form category.
49+
category: 'MEDIUM_RISK_ONE',
50+
// The time associated with discovering the issue.
51+
eventTime: {
52+
seconds: Math.floor(eventTime.getTime() / 1000),
53+
nanos: (eventTime.getTime() % 1000) * 1e6,
54+
},
55+
},
56+
};
57+
const [finding] = await client.createFinding(createFindingTemplate);
58+
createFindingTemplate.findingId = 'untouchedFindingId';
59+
createFindingTemplate.finding.category = 'XSS';
60+
const [untouchedFinding] = await client
61+
.createFinding(createFindingTemplate)
62+
.catch(error => console.error(error));
63+
const sourceId = source.name.split('/')[3];
64+
const findingId = finding.name.split('/')[7];
65+
66+
data = {
67+
orgId: organizationId,
68+
sourceName: source.name,
69+
findingName: finding.name,
70+
untouchedFindingName: untouchedFinding.name,
71+
sourceId: sourceId,
72+
findingId: findingId,
73+
};
74+
console.log('My data security marks %j', data);
75+
});
76+
77+
it('client can add security marks to finding v2', done => {
78+
const output = exec(
79+
`node v2/addFindingSecurityMarks.js ${data.orgId} ${data.sourceId}`
80+
);
81+
assert(output.includes(data.orgId));
82+
assert(output.includes(data.sourceId));
83+
assert.match(output, /key_a/);
84+
assert.match(output, /value_a/);
85+
assert.match(output, /key_b/);
86+
assert.match(output, /value_b/);
87+
assert.notMatch(output, /undefined/);
88+
done();
89+
});
90+
91+
it('client can list findings with security marks v2', done => {
92+
// Ensure marks are set.
93+
exec(`node v2/addFindingSecurityMarks.js ${data.orgId} ${data.sourceId}`);
94+
const output = exec(
95+
`node v2/listFindingsWithSecurityMarks.js ${data.orgId} ${data.sourceId}`
96+
);
97+
assert(!output.includes(data.findingName));
98+
assert(output.includes(data.untouchedFindingName));
99+
assert.notMatch(output, /undefined/);
100+
done();
101+
});
102+
103+
it('client can delete and update findings with security marks v2', done => {
104+
// Ensure marks are set.
105+
exec(`node v2/addFindingSecurityMarks.js ${data.orgId} ${data.sourceId}`);
106+
const output = exec(
107+
`node v2/deleteAndUpdateSecurityMarks.js ${data.orgId} ${data.sourceId}`
108+
);
109+
assert(output.includes(data.orgId));
110+
assert.match(output, /key_a/);
111+
assert.match(output, /new_value_for_a/);
112+
assert.notMatch(output, /key_b/);
113+
assert.notMatch(output, /value_b/);
114+
assert.notMatch(output, /undefined/);
115+
done();
116+
});
117+
118+
it('client can delete and update findings with security marks v2', done => {
119+
// Ensure marks are set.
120+
exec(`node v2/addFindingSecurityMarks.js ${data.orgId} ${data.sourceId}`);
121+
const output = exec(
122+
`node v2/deleteSecurityMarks.js ${data.orgId} ${data.sourceId}`
123+
);
124+
assert(output.includes(data.orgId));
125+
assert.notMatch(output, /key_a/);
126+
assert.notMatch(output, /value_a/);
127+
assert.notMatch(output, /key_b/);
128+
assert.notMatch(output, /value_b/);
129+
assert.notMatch(output, /undefined/);
130+
done();
131+
});
132+
});

‎security-center/snippets/v2/addFindingSecurityMarks.js

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
// Copyright 2024 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
'use strict';
15+
16+
/**
17+
* Demostrates adding security marks to a finding.
18+
*/
19+
function main(
20+
organizationId,
21+
sourceId,
22+
location = 'global',
23+
findingId = 'somefinding'
24+
) {
25+
// [START securitycenter_add_finding_security_marks_v2]
26+
// Imports the Google Cloud client library.
27+
const {SecurityCenterClient} = require('@google-cloud/security-center').v2;
28+
29+
// Creates a new client.
30+
const client = new SecurityCenterClient();
31+
32+
// Build the full resource path for the finding to update.
33+
/*
34+
* TODO(developer): Update the following references for your own environment before running the sample.
35+
*/
36+
// const organizationId = 'YOUR_ORGANIZATION_ID';
37+
// const sourceId = 'SOURCE_ID';
38+
const findingName = `organizations/${organizationId}/sources/${sourceId}/locations/${location}/findings/${findingId}`;
39+
40+
// Construct the request to be sent by the client.
41+
const updateSecurityMarksRequest = {
42+
securityMarks: {
43+
name: `${findingName}/securityMarks`,
44+
marks: {key_a: 'value_a', key_b: 'value_b'},
45+
},
46+
// Only update the marks with these keys.
47+
updateMask: {paths: ['marks.key_a', 'marks.key_b']},
48+
};
49+
50+
async function addFindingSecurityMarks() {
51+
const [newMarks] = await client.updateSecurityMarks(
52+
updateSecurityMarksRequest
53+
);
54+
55+
console.log('New marks: %j', newMarks);
56+
}
57+
addFindingSecurityMarks();
58+
// [END securitycenter_add_finding_security_marks_v2]
59+
}
60+
61+
main(...process.argv.slice(2));

‎security-center/snippets/v2/deleteAndUpdateSecurityMarks.js

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
// Copyright 2024 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
'use strict';
15+
16+
/**
17+
* Demostrates updating and deleting security marks to a finding.
18+
*/
19+
function main(
20+
organizationId,
21+
sourceId,
22+
location = 'global',
23+
findingId = 'somefinding'
24+
) {
25+
// [START securitycenter_add_delete_security_marks_v2]
26+
// Imports the Google Cloud client library.
27+
const {SecurityCenterClient} = require('@google-cloud/security-center').v2;
28+
29+
// Creates a new client.
30+
const client = new SecurityCenterClient();
31+
32+
// Build the full resource path for the finding to update.
33+
/*
34+
* TODO(developer): Update the following references for your own environment before running the sample.
35+
*/
36+
// const organizationId = 'YOUR_ORGANIZATION_ID';
37+
// const sourceId = 'SOURCE_ID';
38+
const findingName = `organizations/${organizationId}/sources/${sourceId}/locations/${location}/findings/${findingId}`;
39+
40+
// Construct the request to be sent by the client.
41+
const updateSecurityMarksRequest = {
42+
securityMarks: {
43+
name: `${findingName}/securityMarks`,
44+
marks: {key_a: 'new_value_for_a'},
45+
},
46+
// Set the update mask to specify which properties should be updated.
47+
// If empty, all mutable fields will be updated.
48+
// For more info on constructing field mask path, see the proto or:
49+
// https://cloud.google.com/java/docs/reference/protobuf/latest/com.google.protobuf.FieldMask.
50+
// Since no marks have been added, including "marks.key_b" in the update mask
51+
// will cause it to be deleted.
52+
updateMask: {paths: ['marks.key_a', 'marks.key_b']},
53+
};
54+
55+
async function UpdateAndDeleteSecurityMarks() {
56+
const [newMarks] = await client.updateSecurityMarks(
57+
updateSecurityMarksRequest
58+
);
59+
60+
console.log('New marks: %j', newMarks);
61+
}
62+
UpdateAndDeleteSecurityMarks();
63+
// [END securitycenter_add_delete_security_marks_v2]
64+
}
65+
66+
main(...process.argv.slice(2));

‎security-center/snippets/v2/deleteSecurityMarks.js

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Copyright 2024 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
'use strict';
16+
17+
/**
18+
* Demostrates deleting security marks on a finding.
19+
*/
20+
function main(
21+
organizationId,
22+
sourceId,
23+
location = 'global',
24+
findingId = 'somefinding'
25+
) {
26+
// [START securitycenter_delete_security_marks_v2]
27+
// Imports the Google Cloud client library.
28+
const {SecurityCenterClient} = require('@google-cloud/security-center').v2;
29+
30+
// Creates a new client.
31+
const client = new SecurityCenterClient();
32+
33+
// Build the full resource path for the finding to update.
34+
/*
35+
* TODO(developer): Update the following references for your own environment before running the sample.
36+
*/
37+
// const organizationId = 'YOUR_ORGANIZATION_ID';
38+
// const sourceId = 'SOURCE_ID';
39+
const findingName = `organizations/${organizationId}/sources/${sourceId}/locations/${location}/findings/${findingId}`;
40+
41+
// Construct the request to be sent by the client.
42+
const updateSecurityMarksRequest = {
43+
securityMarks: {
44+
name: `${findingName}/securityMarks`,
45+
// Intentionally, not setting marks to delete them.
46+
},
47+
// Only delete marks for the following keys.
48+
updateMask: {paths: ['marks.key_a', 'marks.key_b']},
49+
};
50+
51+
async function deleteSecurityMarks() {
52+
const [newMarks] = await client.updateSecurityMarks(
53+
updateSecurityMarksRequest
54+
);
55+
56+
console.log('Updated marks: %j', newMarks);
57+
}
58+
deleteSecurityMarks();
59+
// [END securitycenter_delete_security_marks_v2]
60+
}
61+
62+
main(...process.argv.slice(2));

‎security-center/snippets/v2/listFindingsWithSecurityMarks.js

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Copyright 2024 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
'use strict';
15+
16+
/** Demonstrates listing findings by filtering on security marks. */
17+
function main(organizationId, sourceId) {
18+
// [START securitycenter_list_findings_with_security_marks_v2]
19+
// Imports the Google Cloud client library.
20+
const {SecurityCenterClient} = require('@google-cloud/security-center').v2;
21+
22+
// Creates a new client.
23+
const client = new SecurityCenterClient();
24+
// Build the full resource path for the source to search for findings.
25+
26+
// The source path supports mutliple formats:
27+
// - `${parent}/sources/${sourceId}` without a location
28+
// - `${parent}/sources/${sourceId}/locations/${location}` with a location
29+
// where parent must be in one of the following formats:
30+
// - `organizations/${organization_id}`
31+
// - `folders/${folder_id}`
32+
// - `projects/${project_id}`
33+
34+
/*
35+
* TODO(developer): Update the following references for your own environment before running the sample.
36+
*/
37+
// const organizationId = 'YOUR_ORGANIZATION_ID';
38+
// const sourceId = 'SOURCE_ID';
39+
40+
const sourceName = `organizations/${organizationId}/sources/${sourceId}`;
41+
42+
// Construct the request to be sent by the client.
43+
const listFindingsRequest = {
44+
// List findings across all sources.
45+
parent: sourceName,
46+
filter: 'NOT security_marks.marks.key_a="value_a"',
47+
};
48+
49+
async function listFindingsWithSecurityMarks() {
50+
const [response] = await client.listFindings(listFindingsRequest);
51+
let count = 0;
52+
Array.from(response).forEach(result =>
53+
console.log(
54+
`${++count} ${result.finding.name} ${result.finding.resourceName}`
55+
)
56+
);
57+
}
58+
listFindingsWithSecurityMarks();
59+
// [END securitycenter_list_findings_with_security_marks_v2]
60+
}
61+
62+
main(...process.argv.slice(2));

0 commit comments

Comments
 (0)