feat: add finding_class and indicator fields in Finding (#409)

* feat: add finding_class and indicator fields in Finding

finding_class field is added in order to help our customer to quickly identify and categorize the different findings (threat, vulnerability, misconfiguration, ...). And indicator field is generated to indicate the domain and IP addresses that is causing the threat.

PiperOrigin-RevId: 386975549

Source-Link: googleapis/googleapis@5bf36f2

Source-Link: googleapis/googleapis-gen@b9ab677

* 🦉 Updates from OwlBot

See https://github.com/googleapis/repo-automation-bots/blob/master/packages/owl-bot/README.md

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/finding.proto

@@ -18,6 +18,7 @@ package google.cloud.securitycenter.v1;
 
 import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
+import "google/cloud/securitycenter/v1/indicator.proto";
 import "google/cloud/securitycenter/v1/security_marks.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/timestamp.proto";
@@ -117,6 +118,26 @@ message Finding {
     LOW = 4;
   }
 
+  // Represents what kind of Finding it is.
+  enum FindingClass {
+    // Unspecified finding class.
+    FINDING_CLASS_UNSPECIFIED = 0;
+
+    // Describes unwanted or malicious activity.
+    THREAT = 1;
+
+    // Describes a potential weakness in software that increases risk to
+    // Confidentiality & Integrity & Availability.
+    VULNERABILITY = 2;
+
+    // Describes a potential weakness in cloud resource/asset configuration that
+    // increases risk.
+    MISCONFIGURATION = 3;
+
+    // Describes a security observation that is for informational purposes.
+    OBSERVATION = 4;
+  }
+
   // The relative resource name of this finding. See:
   // https://cloud.google.com/apis/design/resource_names#relative_resource_name
   // Example:
@@ -184,4 +205,14 @@ message Finding {
   // depending on the closest CRM ancestor of the resource associated with the
   // finding.
   string canonical_name = 14;
+
+  // The class of the finding.
+  FindingClass finding_class = 17;
+
+  // Represents what's commonly known as an Indicator of compromise (IoC) in
+  // computer forensics. This is an artifact observed on a network or in an
+  // operating system that, with high confidence, indicates a computer
+  // intrusion.
+  // Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
+  Indicator indicator = 18;
 }

packages/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/indicator.proto

@@ -0,0 +1,40 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v1;
+
+import "google/api/annotations.proto";
+
+option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter";
+option java_multiple_files = true;
+option java_outer_classname = "IndicatorProto";
+option java_package = "com.google.cloud.securitycenter.v1";
+option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
+option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
+option ruby_package = "Google::Cloud::SecurityCenter::V1";
+
+
+// Represents what's commonly known as an Indicator of compromise (IoC) in
+// computer forensics. This is an artifact observed on a network or in an
+// operating system that, with high confidence, indicates a computer intrusion.
+// Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
+message Indicator {
+  // List of ip addresses associated to the Finding.
+  repeated string ip_addresses = 1;
+
+  // List of domains associated to the Finding.
+  repeated string domains = 2;
+}