ログシッパー用 Google Cloud SCC プラグイン

このプラグイン Google Cloud API で認証するための Python ライブラリ。

• ライブラリ: Python 用 Google 認証ライブラリ (google-auth)。
• 使用方法：Google APIへの認証を行うためのPython用Google認証ライブラリ（google-auth）。

Create a new session with credentials

self.gcp_scope = ["https://www.googleapis.com/auth/cloud-platform"]

self.creds = (
                service_account.Credentials.from_service_account_info(
                    json.loads(self.configuration["key_file"])
                )
            )
scoped = self.creds.with_scopes(self.gcp_scope)
self.gcp_session = request.AuthorizedSession(scoped)
self.gcp_session.proxies = self.proxy

Google Cloud GET API Request

response = self.gcp_session.get(
                url,
                headers=headers,
                params=params
)

Google Cloud POST API Request

response = self.gcp_session.post(
               url,
               params=param,
               json=data,
               headers=headers
)

リソースマネージャーAPI

APIエンドポイント	方法	使うケース
/v1/projects/{projectId}	得る	指定された projectId で識別されるプロジェクトを取得します。

ベース URL https://cloudresourcemanager.googleapis.comは、すべてのリソースマネージャ API で共通です。

プロジェクトを取得する

API Endpoint: <Base URL>/v1/projects/{projectId}
Method: GET
Sample API Response:

{
  "projectNumber": "",
  "projectId": "",
  "lifecycleState": "ACTIVE",
  "name": "projectName",
  "createTime": "2024-04-04T10:01:07.553347Z",
  "parent": {
    "type": "organization",
    "id": ""
  }
}

セキュリティコマンドセンターAPI

APIエンドポイント	方法	使うケース
/v1/組織/{organizationId}/sources/{sourceId}/findings	得る	組織または情報源の調査結果を一覧表示します。
/v1/組織/{organizationId}/sources/{sourceId}/findings	役職	調査結果を作成します。創造の発見が成功するためには、対応する情報源が存在しなければならない。
/v1/組織{organizationId}/sources/{sourceId}	得る	情報源を入手してください。
/v1/組織/{organizationId}/sources/{sourceId}	役職	ソースを作成します。

ベース URL https://securitycenter.googleapis.comは、すべてのセキュリティ コマンド センター API で共通です。

調査結果一覧

API endpoint: <Base URL>/v1/組織/{organizationId}/sources/{sourceId}/findings
Method:
Sample API Response:

{
  "listFindingsResults": [
    {
      "finding": {
        "name": "organizations//sources//findings/00087f8800a911ef94c60242c0a8f104",
        "parent": "organizations//sources/",
        "resourceName": "//cloudresourcemanager.googleapis.com/projects/",
        "state": "ACTIVE",
        "category": "ctep",
        "externalUri": "https://drive.google.com/open?id=14WLyjF82rGg",
        "sourceProperties": {
          "cci": "29",
          "timestamp": "1713791120",
          "url": "https://drive.google.com/open?id=14WLyjF82rGg",
          "alert_type": "ctep",
          "tenant_name": "CLS"
        },
        "securityMarks": {
          "name": "organizations//sources//findings/00087f8800a911ef94c60242c0a8f104/securityMarks"
        },
        "eventTime": "2024-04-22T13:05:20Z",
        "createTime": "2024-04-22T13:05:34.141Z",
        "canonicalName": "projects//sources//findings/00087f8800a911ef94c60242c0a8f104",
        "mute": "MUTED",
        "muteUpdateTime": "2024-04-22T13:05:35.371Z",
        "muteInitiator": "Muted by mute rule organizations//muteConfigs/rule8",
        "contacts": {
          "security": {
            "contacts": [
              {
                "email": "systems@abc.com"
              }
            ]
          },
          "technical": {
            "contacts": [
              {
                "email": "systems@abc.com"
              }
            ]
          }
        },
        "parentDisplayName": "test"
      },
      "resource": {
        "name": "//cloudresourcemanager.googleapis.com/projects/",
        "projectName": "//cloudresourcemanager.googleapis.com/projects/",
        "projectDisplayName": "",
        "parentName": "//cloudresourcemanager.googleapis.com/organizations/",
        "parentDisplayName": "abc.com",
        "type": "google.cloud.resourcemanager.Project",
        "displayName": "",
        "cloudProvider": "GOOGLE_CLOUD_PLATFORM",
        "organization": "organizations/",
        "service": "cloudresourcemanager.googleapis.com",
        "resourcePath": {
          "nodes": [
            {
              "nodeType": "GCP_PROJECT",
              "id": "projects/",
              "displayName": ""
            },
            {
              "nodeType": "GCP_ORGANIZATION",
              "id": "organizations/"
            }
          ]
        },
        "resourcePathString": "organizations//projects/"
      }
    }
  ],
  "readTime": "2024-04-22T13:31:00.144Z",
  "nextPageToken": "CsoD3cy7qgAx8Qqf…",
  "totalSize": 22210
}

検索結果を作成する

API endpoint: <Base URL>/v1/組織/{organizationId}/sources/{sourceId}/findings
Method: ポスト
Body:

{
  "name": "/findings/00087f8800a911ef94c60242c0a8f104",
  "parent": "",
  "resourceName": "//cloudresourcemanager.googleapis.com/projects/",
  "state": "ACTIVE",
  "category": "ctep",
  "eventTime": "2024-04-10T07:19:30Z",
  "createTime": "2024-04-10T07:19:31.208001Z",
   …
}

Sample API Response:

{
  "name": "organizations//sources//findings/00087f8800a911ef94c60242c0a8f104",
  "parent": "organizations//sources/",
  "resourceName": "//cloudresourcemanager.googleapis.com/projects/",
  "state": "ACTIVE",
  "category": "ctep",
  "securityMarks": {
    "name": "organizations//sources//findings/00087f8800a911ef94c60242c0a8f104/securityMarks"
  },
  "eventTime": "2024-04-10T07:19:30Z",
  "createTime": "2024-04-22T05:46:05.439Z",
  "canonicalName": "projects//sources//locations/global/findings/00087f8800a911ef94c60242c0a8f104",
  "mute": "MUTED",
  "muteUpdateTime": "2024-04-22T05:46:06.580Z",
  "muteInitiator": "Muted by mute rule organizations//muteConfigs/rule8",
  "contacts": {
    "security": {
      "contacts": [
        {
          "email": "systems@crestdatasys.com"
        }
      ]
    },
    "technical": {
      "contacts": [
        {
          "email": "systems@crestdatasys.com"
        }
      ]
    }
  },
  "parentDisplayName": "test"
}

情報源を入手する

API endpoint: <Base URL>/v1/ 組織{organizationId}/sources/{sourceId}
Method: GET
Sample API Response:

{
  "name": "organizations//sources/",
  "displayName": "Source Name",
  "description": "Source description"
}

ソースを作成する

API Endpoint: <Base URL>/v1/組織{organizationId}/sources/{sourceId}
Method: POST
Body :

{
  "name": "Name of source",
  "displayName": "Unique name of the source",
  "description": "Description of the source"
}

Sample API Response:

{
  "name": "organizations/<org_id>/sources/<source_id>",
  "displayName": "Unique source Name",
  "description": "Source description"
}