@swamp/gcp/securitycenter
v2026.04.23.1
Google Cloud securitycenter infrastructure models
Repository
https://github.com/systeminit/swamp-extensions
Labels
gcpgoogle-cloudsecuritycentercloudinfrastructure
Contents
Quality score
Verified by SwampHow well-documented and verifiable this extension is.
Grade A
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types1/1earned
- Has description1/1earned
- At least one platform tag (or universal)1/1earned
- Two or more platform tags (or universal)1/1earned
- License declared1/1earned
- Verified public repository2/2earned
Install
$ swamp extension pull @swamp/gcp/securitycentermuteconfigs.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| createTime? | string | Output only. The time at which the mute config was created. This field is set by the server and will be ignored if provided on config creation. |
| description? | string | A description of the mute config. |
| expiryTime? | string | Optional. The expiry of the mute config. Only applicable for dynamic configs. If the expiry is set, when the config expires, it is removed from all findings. |
| filter? | string | Required. An expression that defines the filter to apply across create/update events of findings. While creating a filter string, be mindful of the scope in which the mute configuration is being created. E.g., If a filter contains project = X but is created under the project = Y scope, it might not match any findings. The following field and operator combinations are supported: * severity: `=`, `:` * category: `=`, `:` * resource.name: `=`, `:` * resource.project_name: `=`, `:` * resource.project_display_name: `=`, `:` * resource.folders.resource_folder: `=`, `:` * resource.parent_name: `=`, `:` * resource.parent_display_name: `=`, `:` * resource.type: `=`, `:` * finding_class: `=`, `:` * indicator.ip_addresses: `=`, `:` * indicator.domains: `=`, `:` |
| mostRecentEditor? | string | Output only. Email address of the user who last edited the mute config. This field is set by the server and will be ignored if provided on config creation or update. |
| name? | string | This field will be ignored if provided on config creation. Format `organizations/{organization}/muteConfigs/{mute_config}` `folders/{folder}/muteConfigs/{mute_config}` `projects/{project}/muteConfigs/{mute_config}` `organizations/{organization}/locations/global/muteConfigs/{mute_config}` `folders/{folder}/locations/global/muteConfigs/{mute_config}` `projects/{project}/locations/global/muteConfigs/{mute_config}` |
| type? | enum | Optional. The type of the mute config, which determines what type of mute state the config affects. The static mute state takes precedence over the dynamic mute state. Immutable after creation. STATIC by default if not set during creation. |
| updateTime? | string | Output only. The most recent time at which the mute config was updated. This field is set by the server and will be ignored if provided on config creation or update. |
getGet a muteConfigs
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the muteConfigs |
updateUpdate muteConfigs attributes
deleteDelete the muteConfigs
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the muteConfigs |
syncSync muteConfigs state from GCP
securityhealthanalyticssettings_custommodules.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| cloudProvider? | enum | The cloud provider of the custom module. |
| customConfig? | object | Name of the property for the custom output. |
| displayName? | string | The display name of the Security Health Analytics custom module. This display name becomes the finding category for all findings that are returned by this custom module. The display name must be between 1 and 128 characters, start with a lowercase letter, and contain alphanumeric characters or underscores only. |
| enablementState? | enum | The enablement state of the custom module. |
| name? | string | Immutable. The resource name of the custom module. Its format is "organizations/{organization}/securityHealthAnalyticsSettings/customModules/{customModule}", or "folders/{folder}/securityHealthAnalyticsSettings/customModules/{customModule}", or "projects/{project}/securityHealthAnalyticsSettings/customModules/{customModule}" The id {customModule} is server-generated and is not user settable. It will be a numeric id containing 1-20 digits. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
createCreate a customModules
getGet a customModules
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the customModules |
updateUpdate customModules attributes
deleteDelete the customModules
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the customModules |
syncSync customModules state from GCP
list_descendantlist descendant
simulatesimulate
| Argument | Type | Description |
|---|---|---|
| customConfig? | any | |
| resource? | any |
simulations.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
getGet a simulations
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the simulations |
syncSync simulations state from GCP
simulations_valuedresources_attackpaths.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a attackPaths
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the attackPaths |
syncSync attackPaths state from GCP
simulations_valuedresources.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a valuedResources
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the valuedResources |
syncSync valuedResources state from GCP
simulations_attackexposureresults_attackpaths.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a attackPaths
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the attackPaths |
syncSync attackPaths state from GCP
simulations_attackpaths.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a attackPaths
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the attackPaths |
syncSync attackPaths state from GCP
attackpaths.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a attackPaths
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the attackPaths |
syncSync attackPaths state from GCP
sources_findings.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| access? | object | Caller\'s IP address, such as "1.1.1.1". |
| affectedResources? | object | The count of resources affected by the finding. |
| agentDataAccessEvents? | array | Unique identifier for data access event. |
| aiModel? | object | The platform on which the model is deployed. |
| application? | object | The base URI that identifies the network location of the application in which the vulnerability was detected. For example, `http://example.com`. |
| artifactGuardPolicies? | object | The reason for the policy failure, for example, "severity=HIGH AND max_vuln_count=2". |
| attackExposure? | object | The resource name of the attack path simulation result that contains the details regarding this attack exposure score. Example: `organizations/123/simulations/456/attackExposureResults/789` |
| backupDisasterRecovery? | object | The name of the Backup and DR appliance that captures, moves, and manages the lifecycle of backup data. For example, `backup-server-57137`. |
| canonicalName? | string | The canonical name of the finding. It\'s either "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or "projects/{project_number}/sources/{source_id}/findings/{finding_id}", depending on the closest CRM ancestor of the resource associated with the finding. |
| category? | string | The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION" |
| chokepoint? | object | List of resource names of findings associated with this chokepoint. For example, organizations/123/sources/456/findings/789. This list will have at most 100 findings. |
| cloudArmor? | object | A score of 0 means that there is low confidence that the detected event is an actual attack. A score of 1 means that there is high confidence that the detected event is an attack. See the [Adaptive Protection documentation](https://cloud.google.com/armor/docs/adaptive-protection-overview#configure-alert-tuning) for further explanation. |
| cloudDlpDataProfile? | object | Name of the data profile, for example, `projects/123/locations/europe/tableProfiles/8383929`. |
| cloudDlpInspection? | object | Whether Cloud DLP scanned the complete resource or a sampled subset. |
| complianceDetails? | object | Name of the CloudControl associated with the finding. |
| compliances? | array | Policies within the standard or benchmark, for example, A.12.4.1 |
| connections? | array | Destination IP address. Not present for sockets that are listening and not connected. |
| contacts? | record | An email address. For example, "`person123@company.com`". |
| containers? | array | The time that the container was created. |
| createTime? | string | The time at which the finding was created in Security Command Center. |
| dataAccessEvents? | array | Unique identifier for data access event. |
| dataFlowEvents? | array | Unique identifier for data flow event. |
| dataRetentionDeletionEvents? | array | Number of objects that violated the policy for this resource. If the number is less than 1,000, then the value of this field is the exact number. If the number of objects that violated the policy is greater than or equal to 1,000, then the value of this field is 1000. |
| database? | object | The human-readable name of the database that the user connected to. |
| description? | string | Contains more details about the finding. |
| discoveredWorkload? | object | The confidence in detection of this workload. |
| disk? | object | The name of the disk, for example, "https://www.googleapis.com/compute/v1/projects/{project-id}/zones/{zone-id}/disks/{disk-id}". |
| eventTime? | string | The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp. |
| exfiltration? | object | Subcomponents of the asset that was exfiltrated, like URIs used during exfiltration, table names, databases, and filenames. For example, multiple tables might have been exfiltrated from the same Cloud SQL instance, or multiple files might have been exfiltrated from the same Cloud Storage bucket. |
| externalExposure? | object | The full resource name of load balancer backend service, for example, "//compute.googleapis.com/projects/{project-id}/global/backendServices/{name}". |
| externalSystems? | record | References primary/secondary etc assignees in the external system. |
| externalUri? | string | The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL. |
| files? | array | Prefix of the file contents as a JSON-encoded string. |
| findingClass? | enum | The class of the finding. |
| groupMemberships? | array | ID of the group. |
| iamBindings? | array | The action that was performed on a Binding. |
| indicator? | object | List of domains associated to the Finding. |
| ipRules? | object | Optional. An optional list of ports to which this rule applies. This field is only applicable for the UDP or (S)TCP protocols. Each entry must be either an integer or a range including a min and max port number. |
| job? | object | Optional. If the job did not complete successfully, this field describes why. |
| kernelRootkit? | object | Rootkit name, when available. |
| kubernetes? | object | The API group of the resource. "*" means all. |
| loadBalancers? | array | The name of the load balancer associated with the finding. |
| logEntries? | array | A unique identifier for the log entry. |
| mitreAttack? | object | Additional MITRE ATT&CK tactics related to this finding, if any. |
| moduleName? | string | Unique identifier of the module which generated the finding. Example: folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885 |
| mute? | enum | Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute. |
| muteInfo? | object | When the dynamic mute rule first matched the finding. |
| muteInitiator? | string | Records additional information about the mute operation, for example, the [mute configuration](/security-command-center/docs/how-to-mute-findings) that muted the finding and the user who muted the finding. |
| muteUpdateTime? | string | Output only. The most recent time this finding was muted or unmuted. |
| name? | string | The [relative resource name](https://cloud.google.com/apis/design/resource_names#relative_resource_name) of the finding. Example: "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}", "folders/{folder_id}/sources/{source_id}/findings/{finding_id}", "projects/{project_id}/sources/{source_id}/findings/{finding_id}". |
| networks? | array | The name of the VPC network resource, for example, `//compute.googleapis.com/projects/my-project/global/networks/my-network`. |
| nextSteps? | string | Steps to address the finding. |
| notebook? | object | The user ID of the latest author to modify the notebook. |
| orgPolicies? | array | The resource name of the org policy. Example: "organizations/{organization_id}/policies/{constraint_name}" |
| parent? | string | The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/{organization_id}/sources/{source_id}" |
| parentDisplayName? | string | Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics". |
| policyViolationSummary? | object | Total number of child resources that conform to the policy. |
| processes? | array | Process arguments as JSON encoded strings. |
| resourceName? | string | For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time. |
| secret? | object | Environment variable name as a JSON encoded string. Note that value is not included since the value contains the secret data, which is sensitive core content. |
| securityMarks? | object | The canonical name of the marks. Examples: "organizations/{organization_id}/assets/{asset_id}/securityMarks" "folders/{folder_id}/assets/{asset_id}/securityMarks" "projects/{project_number}/assets/{asset_id}/securityMarks" "organizations/{organization_id}/sources/{source_id}/findings/{finding_id}/securityMarks" "folders/{folder_id}/sources/{source_id}/findings/{finding_id}/securityMarks" "projects/{project_number}/sources/{source_id}/findings/{finding_id}/securityMarks" |
| securityPosture? | object | The name of the updated policy, for example, `projects/{project_id}/policies/{constraint_name}`. |
| severity? | enum | The severity of the finding. This field is managed by the source that writes the finding. |
| sourceProperties? | record | Source specific properties. These properties are managed by the source that writes the finding. The key names in the source_properties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only. |
| state? | enum | The state of the finding. |
| toxicCombination? | object | The [Attack exposure score](https://cloud.google.com/security-command-center/docs/attack-exposure-learn#attack_exposure_scores) of this toxic combination. The score is a measure of how much this toxic combination exposes one or more high-value resources to potential attack. |
| vertexAi? | object | The user defined display name of dataset, e.g. plants-dataset |
| vulnerability? | object | This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability. |
getGet a findings
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the findings |
updateUpdate findings attributes
syncSync findings state from GCP
groupgroup
| Argument | Type | Description |
|---|---|---|
| compareDuration? | any | |
| filter? | any | |
| groupBy? | any | |
| pageSize? | any | |
| pageToken? | any | |
| readTime? | any |
set_muteset mute
| Argument | Type | Description |
|---|---|---|
| mute? | any |
set_stateset state
| Argument | Type | Description |
|---|---|---|
| startTime? | any | |
| state? | any |
update_security_marksupdate security marks
| Argument | Type | Description |
|---|---|---|
| canonicalName? | any | |
| marks? | any | |
| name? | any |
eventthreatdetectionsettings_effectivecustommodules.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a effectiveCustomModules
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the effectiveCustomModules |
syncSync effectiveCustomModules state from GCP
securityhealthanalyticssettings_effectivecustommodules.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a effectiveCustomModules
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the effectiveCustomModules |
syncSync effectiveCustomModules state from GCP
eventthreatdetectionsettings_custommodules.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| cloudProvider? | enum | The cloud provider of the custom module. |
| config? | record | Config for the module. For the resident module, its config value is defined at this level. For the inherited module, its config value is inherited from the ancestor module. |
| description? | string | The description for the module. |
| displayName? | string | The human readable name to be displayed for the module. |
| enablementState? | enum | The state of enablement for the module at the given level of the hierarchy. |
| name? | string | Immutable. The resource name of the Event Threat Detection custom module. Its format is: * `organizations/{organization}/eventThreatDetectionSettings/customModules/{module}`. * `folders/{folder}/eventThreatDetectionSettings/customModules/{module}`. * `projects/{project}/eventThreatDetectionSettings/customModules/{module}`. |
| type? | string | Type for the module. e.g. CONFIGURABLE_BAD_IP. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
createCreate a customModules
getGet a customModules
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the customModules |
updateUpdate customModules attributes
deleteDelete the customModules
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the customModules |
syncSync customModules state from GCP
list_descendantlist descendant
simulations_attackexposureresults_valuedresources.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a valuedResources
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the valuedResources |
syncSync valuedResources state from GCP
valuedresources.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a valuedResources
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the valuedResources |
syncSync valuedResources state from GCP
resourcevalueconfigs.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| cloudProvider? | enum | Cloud provider this configuration applies to |
| createTime? | string | Output only. Timestamp this resource value configuration was created. |
| description? | string | Description of the resource value configuration. |
| name? | string | Name for the resource value configuration |
| resourceLabelsSelector? | record | List of resource labels to search for, evaluated with `AND`. For example, `"resource_labels_selector": {"key": "value", "env": "prod"}` will match resources with labels "key": "value" `AND` "env": "prod" https://cloud.google.com/resource-manager/docs/creating-managing-labels |
| resourceType? | string | Apply resource_value only to resources that match resource_type. resource_type will be checked with `AND` of other resources. For example, "storage.googleapis.com/Bucket" with resource_value "HIGH" will apply "HIGH" value only to "storage.googleapis.com/Bucket" resources. |
| resourceValue? | enum | Required. Resource value level this expression represents |
| scope? | string | Project or folder to scope this configuration to. For example, "project/456" would apply this configuration only to resources in "project/456" scope will be checked with `AND` of other resources. |
| sensitiveDataProtectionMapping? | object | Resource value mapping for high-sensitivity Sensitive Data Protection findings |
| tagValues? | array | Required. Tag values combined with `AND` to check against. For Google Cloud resources, they are tag value IDs in the form of "tagValues/123". Example: `[ "tagValues/123", "tagValues/456", "tagValues/789" ]` https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing |
| updateTime? | string | Output only. Timestamp this resource value configuration was last updated. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a resourceValueConfigs
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the resourceValueConfigs |
updateUpdate resourceValueConfigs attributes
deleteDelete the resourceValueConfigs
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the resourceValueConfigs |
syncSync resourceValueConfigs state from GCP
batch_createbatch create
| Argument | Type | Description |
|---|---|---|
| requests? | any |
notificationconfigs.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| description? | string | The description of the notification config (max of 1024 characters). |
| name? | string | The relative resource name of this notification config. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/notificationConfigs/notify_public_bucket", "folders/{folder_id}/notificationConfigs/notify_public_bucket", or "projects/{project_id}/notificationConfigs/notify_public_bucket". |
| pubsubTopic? | string | The Pub/Sub topic to send notifications to. Its format is "projects/[project_id]/topics/[topic]". |
| streamingConfig? | object | Expression that defines the filter to apply across create/update events of assets or findings as specified by the event type. The expression is a list of zero or more restrictions combined via logical operators `AND` and `OR`. Parentheses are supported, and `OR` has higher precedence than `AND`. Restrictions have the form ` ` and may have a `-` character in front of them to indicate negation. The fields map to those defined in the corresponding resource. The supported operators are: * `=` for all value types. * `>`, `=`, `<=` for integer values. * `:`, meaning substring matching, for strings. The supported value types are: * string literals in quotes. * integer literals without quotes. * boolean literals `true` and `false` without quotes. |
| configId? | string | Required. Unique identifier provided by the client within the parent scope. It must be between 1 and 128 characters and contain alphanumeric characters, underscores, or hyphens only. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
createCreate a notificationConfigs
getGet a notificationConfigs
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the notificationConfigs |
updateUpdate notificationConfigs attributes
deleteDelete the notificationConfigs
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the notificationConfigs |
syncSync notificationConfigs state from GCP
assets.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a assets
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the assets |
syncSync assets state from GCP
groupgroup
| Argument | Type | Description |
|---|---|---|
| compareDuration? | any | |
| filter? | any | |
| groupBy? | any | |
| pageSize? | any | |
| pageToken? | any | |
| readTime? | any |
update_security_marksupdate security marks
| Argument | Type | Description |
|---|---|---|
| canonicalName? | any | |
| marks? | any | |
| name? | any |
bigqueryexports.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| dataset? | string | The dataset to write findings\' updates to. Its format is "projects/[project_id]/datasets/[bigquery_dataset_id]". BigQuery Dataset unique ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). |
| description? | string | The description of the export (max of 1024 characters). |
| filter? | string | Expression that defines the filter to apply across create/update events of findings. The expression is a list of zero or more restrictions combined via logical operators `AND` and `OR`. Parentheses are supported, and `OR` has higher precedence than `AND`. Restrictions have the form ` ` and may have a `-` character in front of them to indicate negation. The fields map to those defined in the corresponding resource. The supported operators are: * `=` for all value types. * `>`, `=`, `<=` for integer values. * `:`, meaning substring matching, for strings. The supported value types are: * string literals in quotes. * integer literals without quotes. * boolean literals `true` and `false` without quotes. |
| name? | string | The relative resource name of this export. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name. Example format: "organizations/{organization_id}/bigQueryExports/{export_id}" Example format: "folders/{folder_id}/bigQueryExports/{export_id}" Example format: "projects/{project_id}/bigQueryExports/{export_id}" This field is provided in responses, and is ignored when provided in create requests. |
| bigQueryExportId? | string | Required. Unique identifier provided by the client within the parent scope. It must consist of only lowercase letters, numbers, and hyphens, must start with a letter, must end with either a letter or a number, and must be 63 characters or less. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
createCreate a bigQueryExports
getGet a bigQueryExports
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the bigQueryExports |
updateUpdate bigQueryExports attributes
deleteDelete the bigQueryExports
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the bigQueryExports |
syncSync bigQueryExports state from GCP
sources.tsv2026.04.23.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
getGet a sources
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the sources |
syncSync sources state from GCP
2026.04.04.1143.6 KBApr 4, 2026
Google Cloud securitycenter infrastructure models
Release Notes
- Updated: securityhealthanalyticssettings_custommodules, securityhealthanalyticssettings_effectivecustommodules, sources_findings
linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64
gcpgoogle-cloudsecuritycentercloudinfrastructure
2026.04.03.3143.4 KBApr 3, 2026
Google Cloud securitycenter infrastructure models
Release Notes
- Updated: assets, bigqueryexports, eventthreatdetectionsettings_custommodules, eventthreatdetectionsettings_effectivecustommodules, muteconfigs, notificationconfigs, securityhealthanalyticssettings_custommodules, securityhealthanalyticssettings_effectivecustommodules, sources, sources_findings, attackpaths, resourcevalueconfigs, simulations, simulations_attackexposureresults_attackpaths, simulations_attackexposureresults_valuedresources, simulations_attackpaths, simulations_valuedresources, simulations_valuedresources_attackpaths, valuedresources
linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64
gcpgoogle-cloudsecuritycentercloudinfrastructure
2026.04.03.1141.3 KBApr 3, 2026
Google Cloud securitycenter infrastructure models
Release Notes
- Updated: assets, bigqueryexports, eventthreatdetectionsettings_custommodules, eventthreatdetectionsettings_effectivecustommodules, muteconfigs, notificationconfigs, securityhealthanalyticssettings_custommodules, securityhealthanalyticssettings_effectivecustommodules, sources, sources_findings, attackpaths, resourcevalueconfigs, simulations, simulations_attackexposureresults_attackpaths, simulations_attackexposureresults_valuedresources, simulations_attackpaths, simulations_valuedresources, simulations_valuedresources_attackpaths, valuedresources
linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64
gcpgoogle-cloudsecuritycentercloudinfrastructure
2026.04.02.2142.1 KBApr 2, 2026
Google Cloud securitycenter infrastructure models
Release Notes
- Updated: sources_findings
Changelog
Models
~methods: -update, -delete, -batch_create
linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64
gcpgoogle-cloudsecuritycentercloudinfrastructure
2026.03.31.1140.8 KBMar 31, 2026
Google Cloud securitycenter infrastructure models
Release Notes
- Updated: sources_findings
linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64
gcpgoogle-cloudsecuritycentercloudinfrastructure
2026.03.27.1139.1 KBMar 27, 2026
Google Cloud securitycenter infrastructure models
Release Notes
- Added: assets, bigqueryexports, eventthreatdetectionsettings_custommodules, eventthreatdetectionsettings_effectivecustommodules, muteconfigs, notificationconfigs, securityhealthanalyticssettings_custommodules, securityhealthanalyticssettings_effectivecustommodules, sources, sources_findings, attackpaths, resourcevalueconfigs, simulations, simulations_attackexposureresults_attackpaths, simulations_attackexposureresults_valuedresources, simulations_attackpaths, simulations_valuedresources, simulations_valuedresources_attackpaths, valuedresources
linux-x86_64linux-aarch64darwin-x86_64darwin-aarch64
gcpgoogle-cloudsecuritycentercloudinfrastructure