Class: Google::Apis::SecuritycenterV1p1beta1::GroupFindingsRequest
- Inherits:
-
Object
- Object
- Google::Apis::SecuritycenterV1p1beta1::GroupFindingsRequest
- Includes:
- Core::Hashable, Core::JsonObjectSupport
- Defined in:
- generated/google/apis/securitycenter_v1p1beta1/classes.rb,
generated/google/apis/securitycenter_v1p1beta1/representations.rb,
generated/google/apis/securitycenter_v1p1beta1/representations.rb
Overview
Request message for grouping by findings.
Instance Attribute Summary collapse
-
#compare_duration ⇒ String
When compare_duration is set, the GroupResult's "state_change" attribute is updated to indicate whether the finding had its state changed, the finding's state remained unchanged, or if the finding was added during the compare_duration period of time that precedes the read_time.
-
#filter ⇒ String
Expression that defines the filter to apply across findings.
-
#group_by ⇒ String
Required.
-
#page_size ⇒ Fixnum
The maximum number of results to return in a single response.
-
#page_token ⇒ String
The value returned by the last
GroupFindingsResponse
; indicates that this is a continuation of a priorGroupFindings
call, and that the system should return the next page of data. -
#read_time ⇒ String
Time used as a reference point when filtering findings.
Instance Method Summary collapse
-
#initialize(**args) ⇒ GroupFindingsRequest
constructor
A new instance of GroupFindingsRequest.
-
#update!(**args) ⇒ Object
Update properties of this object.
Methods included from Core::JsonObjectSupport
Methods included from Core::Hashable
Constructor Details
#initialize(**args) ⇒ GroupFindingsRequest
Returns a new instance of GroupFindingsRequest.
1091 1092 1093 |
# File 'generated/google/apis/securitycenter_v1p1beta1/classes.rb', line 1091 def initialize(**args) update!(**args) end |
Instance Attribute Details
#compare_duration ⇒ String
When compare_duration is set, the GroupResult's "state_change" attribute is updated to indicate whether the finding had its state changed, the finding's state remained unchanged, or if the finding was added during the compare_duration period of time that precedes the read_time. This is the time between (read_time - compare_duration) and read_time. The state_change value is derived based on the presence and state of the finding at the two points in time. Intermediate state changes between the two times don't affect the result. For example, the results aren't affected if the finding is made inactive and then active again. Possible "state_change" values when compare_duration is specified:
- "CHANGED": indicates that the finding was present at the start of compare_duration, but changed its state at read_time.
- "UNCHANGED": indicates that the finding was present at the start of compare_duration and did not change state at read_time.
- "ADDED": indicates that the finding was not present at the start
of compare_duration, but was present at read_time.
If compare_duration is not specified, then the only possible state_change
is "UNUSED", which will be the state_change set for all findings present
at read_time.
If this field is set then
state_change
must be a specified field ingroup_by
. Corresponds to the JSON propertycompareDuration
1017 1018 1019 |
# File 'generated/google/apis/securitycenter_v1p1beta1/classes.rb', line 1017 def compare_duration @compare_duration end |
#filter ⇒ String
Expression that defines the filter to apply across findings.
The expression is a list of one or more restrictions combined via logical
operators AND
and OR
.
Parentheses are supported, and OR
has higher precedence than AND
.
Restrictions have the form <field> <operator> <value>
and may have a -
character in front of them to indicate negation. Examples include:
- name
- source_properties.a_property
- security_marks.marks.marka The supported operators are:
=
for all value types.>
,<
,>=
,<=
for integer values.:
, meaning substring matching, for strings. The supported value types are:- string literals in quotes.
- integer literals without quotes.
- boolean literals
true
andfalse
without quotes. The following field and operator combinations are supported: - name:
=
- parent:
=
,:
- resource_name:
=
,:
- state:
=
,:
- category:
=
,:
- external_uri:
=
,:
- event_time:
=
,>
,<
,>=
,<=
Usage: This should be milliseconds since epoch or an RFC3339 string. Examples: "event_time = \"2019-06-10T16:07:18-07:00\"" "event_time = 1560208038000" - security_marks.marks:
=
,:
- source_properties:
=
,:
,>
,<
,>=
,<=
For example,source_properties.size = 100
is a valid filter string. Corresponds to the JSON propertyfilter
1053 1054 1055 |
# File 'generated/google/apis/securitycenter_v1p1beta1/classes.rb', line 1053 def filter @filter end |
#group_by ⇒ String
Required. Expression that defines what assets fields to use for grouping (
including
state_change
). The string value should follow SQL syntax: comma separated
list of fields. For example: "parent,resource_name".
The following fields are supported:
- resource_name
- category
- state
- parent The following fields are supported when compare_duration is set:
- state_change
Corresponds to the JSON property
groupBy
1068 1069 1070 |
# File 'generated/google/apis/securitycenter_v1p1beta1/classes.rb', line 1068 def group_by @group_by end |
#page_size ⇒ Fixnum
The maximum number of results to return in a single response. Default is
10, minimum is 1, maximum is 1000.
Corresponds to the JSON property pageSize
1074 1075 1076 |
# File 'generated/google/apis/securitycenter_v1p1beta1/classes.rb', line 1074 def page_size @page_size end |
#page_token ⇒ String
The value returned by the last GroupFindingsResponse
; indicates
that this is a continuation of a prior GroupFindings
call, and
that the system should return the next page of data.
Corresponds to the JSON property pageToken
1081 1082 1083 |
# File 'generated/google/apis/securitycenter_v1p1beta1/classes.rb', line 1081 def page_token @page_token end |
#read_time ⇒ String
Time used as a reference point when filtering findings. The filter is
limited to findings existing at the supplied time and their values are
those at that specific time. Absence of this field will default to the
API's version of NOW.
Corresponds to the JSON property readTime
1089 1090 1091 |
# File 'generated/google/apis/securitycenter_v1p1beta1/classes.rb', line 1089 def read_time @read_time end |
Instance Method Details
#update!(**args) ⇒ Object
Update properties of this object
1096 1097 1098 1099 1100 1101 1102 1103 |
# File 'generated/google/apis/securitycenter_v1p1beta1/classes.rb', line 1096 def update!(**args) @compare_duration = args[:compare_duration] if args.key?(:compare_duration) @filter = args[:filter] if args.key?(:filter) @group_by = args[:group_by] if args.key?(:group_by) @page_size = args[:page_size] if args.key?(:page_size) @page_token = args[:page_token] if args.key?(:page_token) @read_time = args[:read_time] if args.key?(:read_time) end |