Gcp/threatintelligence
@swamp/gcp/threatintelligencev2026.07.31.1
01README
Google Cloud threatintelligence infrastructure models
02Release Notes
- Updated: alerts
03Models
@swamp/gcp/threatintelligence/alertsv2026.07.31.1alerts.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn get(identifier: string)
Get a alerts
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the alerts |
fn sync(identifier?: string)
Sync alerts state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific alerts by name (e.g. one discovered by list) |
fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)
List alerts resources
| Argument | Type | Description |
|---|---|---|
| filter? | string | Optional. Filter criteria. Supported fields for filtering include: * `audit.create_time` * `audit.creator` * `audit.update_time` * `audit.updater` * `detail.data_leak.discovery_document_ids` * `detail.data_leak.severity` * `detail.detail_type` * `detail.initial_access_broker.discovery_document_ids` * `detail.initial_access_broker.severity` * `detail.insider_threat.discovery_document_ids` * `detail.insider_threat.severity` * `finding_count` * `priority_analysis.priority_level` * `relevance_analys |
| orderBy? | string | Optional. Order by criteria in the csv format: "field1, field2 desc" or "field1, field2" or "field1 asc, field2". If a field is specified without `asc` or `desc`, ascending order is used by default. Supported fields for ordering are identical to those supported for filtering. Examples: * `audit.create_time desc` * `audit.update_time asc` * `audit.create_time desc, severity_analysis.severity_level desc` |
| pageSize? | number | Optional. Page size. Default to 100 alerts per page. Maximum is 1000 alerts per page. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn benign()
benign
fn duplicate(duplicateOf?: any)
duplicate
| Argument | Type | Description |
|---|---|---|
| duplicateOf? | any |
fn enumerate_facets()
enumerate facets
fn escalate()
escalate
fn false_positive()
false positive
fn get_password()
get password
fn not_actionable()
not actionable
fn read()
read
fn resolve()
resolve
fn track_externally()
track externally
fn triage()
triage
Resources
state(infinite)— Stateful object representing a group of Findings. Key feature to an Alert is ...
@swamp/gcp/threatintelligence/alerts-documentsv2026.07.29.1alerts_documents.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
fn get(identifier: string)
Get a documents
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the documents |
fn sync(identifier?: string)
Sync documents state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific documents by name (e.g. one discovered by list) |
Resources
state(infinite)— A document that is associated with an alert.
@swamp/gcp/threatintelligence/configurationsv2026.07.29.1configurations.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn get(identifier: string)
Get a configurations
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the configurations |
fn sync(identifier?: string)
Sync configurations state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific configurations by name (e.g. one discovered by list) |
fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)
List configurations resources
| Argument | Type | Description |
|---|---|---|
| filter? | string | Optional. Filter criteria. |
| orderBy? | string | Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2". |
| pageSize? | number | Optional. Page size. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn upsert(audit?: any, description?: any, detail?: any, displayName?: any, etag?: any, name?: any, provider?: any, state?: any, version?: any)
upsert
| Argument | Type | Description |
|---|---|---|
| audit? | any | |
| description? | any | |
| detail? | any | |
| displayName? | any | |
| etag? | any | |
| name? | any | |
| provider? | any | |
| state? | any | |
| version? | any |
Resources
state(infinite)— A configuration represents a behavior an engine should follow when producing ...
@swamp/gcp/threatintelligence/configurations-revisionsv2026.07.29.1configurations_revisions.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| parent? | string | The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456) |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn get(identifier: string)
Get a revisions
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the revisions |
fn sync(identifier?: string)
Sync revisions state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific revisions by name (e.g. one discovered by list) |
fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)
List revisions resources
| Argument | Type | Description |
|---|---|---|
| filter? | string | Optional. An AIP-160 filter string |
| orderBy? | string | Optional. Specify ordering of response |
| pageSize? | number | Optional. Page Size |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
Resources
state(infinite)— A ConfigurationRevision is a snapshot of a Configuration at a point in time. ...
@swamp/gcp/threatintelligence/findingsv2026.07.29.1findings.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessToken? | string | GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| credentialsJson? | string | GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| project? | string | GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables. |
| scopes? | string | Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes. |
| quotaProject? | string | GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials. |
| location? | string | The location for this resource (e.g., 'us', 'us-central1', 'europe-west1') |
fn get(identifier: string)
Get a findings
| Argument | Type | Description |
|---|---|---|
| identifier | string | The name of the findings |
fn sync(identifier?: string)
Sync findings state from GCP
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific findings by name (e.g. one discovered by list) |
fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)
List findings resources
| Argument | Type | Description |
|---|---|---|
| filter? | string | Optional. Filter criteria. |
| orderBy? | string | Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2". |
| pageSize? | number | Optional. Page size. |
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
fn search()
search
Resources
state(infinite)— A ‘stateless’ and a point in time event that a check produced a result of int...
04Previous Versions
2026.07.29.1
- Updated: alerts, alerts_documents, configurations, configurations_revisions, findings
2026.07.24.1
- Updated: alerts
Modified 1 models
2026.07.21.3
- Updated: alerts, configurations, configurations_revisions, findings
2026.07.20.2
- Updated: alerts, configurations, configurations_revisions, findings
2026.07.20.1
- Updated: alerts, alerts_documents, configurations, configurations_revisions, findings
2026.07.19.1
- Updated: alerts, alerts_documents, configurations, configurations_revisions, findings
2026.07.18.2
- Updated: alerts, alerts_documents, configurations, configurations_revisions, findings
2026.07.17.1
- Updated: alerts, configurations, configurations_revisions, findings
2026.06.15.1
- Updated: alerts, configurations, configurations_revisions, findings
2026.06.08.2
- Updated: alerts, alerts_documents, configurations, configurations_revisions, findings
2026.06.07.1
- Updated: alerts, alerts_documents, configurations, configurations_revisions, findings
2026.05.27.1
- Updated: configurations, configurations_revisions
2026.05.26.1
- Updated: alerts
2026.05.25.1
- Updated: alerts, alerts_documents, configurations, configurations_revisions, findings
Modified 4 models
2026.05.24.1
- Updated: alerts, alerts_documents, configurations, configurations_revisions, findings
2026.05.21.2
- Updated: alerts, alerts_documents, configurations, configurations_revisions, findings
2026.05.21.1
2026.05.19.2
2026.05.19.1
05Stats
A
100 / 100
Downloads
0
Archive size
54.8 KB
Verified by Swamp
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned
06Platforms
07Labels