Skip to content

Commit 9280b80

Browse files
nimamnimam
authored
Add Chronicle Findings Refinement to terraform (#17659)
1 parent 1adfce9 commit 9280b80

3 files changed

Lines changed: 168 additions & 0 deletions

File tree

‎mmv1/products/chronicle/FindingsRefinement.yaml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
# Copyright 2026 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: FindingsRefinement
16+
description: Represents a set of logic conditions used to refine various types of findings such as curated rule detections.
17+
references:
18+
guides:
19+
'Google SecOps Guides': 'https://cloud.google.com/chronicle/docs/secops/secops-overview'
20+
api: 'https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.findingsRefinements'
21+
min_version: 'beta'
22+
23+
base_url: projects/{{project}}/locations/{{location}}/instances/{{instance}}/findingsRefinements
24+
self_link: projects/{{project}}/locations/{{location}}/instances/{{instance}}/findingsRefinements/{{name}}
25+
create_url: projects/{{project}}/locations/{{location}}/instances/{{instance}}/findingsRefinements
26+
id_format: projects/{{project}}/locations/{{location}}/instances/{{instance}}/findingsRefinements/{{name}}
27+
update_mask: true
28+
update_verb: PATCH
29+
# The API does not support deletion of FindingsRefinements.
30+
exclude_delete: true
31+
import_format:
32+
- projects/{{project}}/locations/{{location}}/instances/{{instance}}/findingsRefinements/{{name}}
33+
autogen_status: RmluZGluZ3NSZWZpbmVtZW50
34+
35+
examples:
36+
- name: 'chronicle_findings_refinement_basic'
37+
primary_resource_id: 'findings_refinement_example'
38+
test_env_vars:
39+
chronicle_id: 'CHRONICLE_ID'
40+
vars:
41+
display_name: findings_refinement_display_name
42+
43+
samples:
44+
- name: 'chronicle_findings_refinement_update'
45+
primary_resource_id: 'findings_refinement_example'
46+
min_version: beta
47+
steps:
48+
- name: 'chronicle_findings_refinement_full'
49+
test_env_vars:
50+
chronicle_id: 'CHRONICLE_ID'
51+
resource_id_vars:
52+
display_name: findings_refinement_display_name
53+
vars:
54+
query: "network.dns.response = true"
55+
outcome_variable: "risk_score"
56+
outcome_filter_operator: "EQUAL"
57+
outcome_value: "value1"
58+
- name: 'chronicle_findings_refinement_full'
59+
test_env_vars:
60+
chronicle_id: 'CHRONICLE_ID'
61+
resource_id_vars:
62+
display_name: findings_refinement_display_name
63+
vars:
64+
query: "network.dns.response = true"
65+
outcome_variable: "risk_score"
66+
outcome_filter_operator: "CONTAINS"
67+
outcome_value: "value2"
68+
69+
parameters:
70+
- name: location
71+
type: String
72+
required: true
73+
description: Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
74+
immutable: true
75+
url_param_only: true
76+
- name: instance
77+
type: String
78+
required: true
79+
description: Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
80+
immutable: true
81+
url_param_only: true
82+
properties:
83+
- name: createTime
84+
type: String
85+
description: The timestamp of when the findings refinement was created.
86+
output: true
87+
- name: displayName
88+
type: String
89+
description: Display name of the findings refinement.
90+
- name: name
91+
type: String
92+
output: true
93+
custom_flatten: 'templates/terraform/custom_flatten/name_from_self_link.tmpl'
94+
description: |-
95+
Full resource name for the findings refinement.
96+
Format:
97+
projects/{project}/locations/{location}/instances/{instance}/findingsRefinements/{findings_refinement}
98+
- name: outcomeFilters
99+
type: Array
100+
description: |-
101+
The outcome filters for the findings refinement. These allow you to specify
102+
filters that are applied to the outcome variables in the detection.
103+
All filters must be true for a detection to match the findings refinement.
104+
item_type:
105+
type: NestedObject
106+
properties:
107+
- name: outcomeFilterOperator
108+
type: String
109+
required: true
110+
description: |-
111+
The operator to be applied to the outcome variable.
112+
Possible values:
113+
EQUAL
114+
CONTAINS
115+
MATCHES_REGEX
116+
MATCHES_CIDR
117+
- name: outcomeValue
118+
type: String
119+
required: true
120+
description: The value of the outcome variable to match.
121+
- name: outcomeVariable
122+
type: String
123+
required: true
124+
description: The outcome variable name.
125+
- name: query
126+
type: String
127+
description: |-
128+
The query for the findings refinement. Works in conjunction with the type
129+
field to determine the findings refinement behavior. The syntax of this
130+
query is the same as a UDM search string. See the following for more
131+
information:
132+
https://cloud.google.com/chronicle/docs/investigation/udm-search
133+
- name: type
134+
type: String
135+
description: |-
136+
DETECTION_EXCLUSION is the only supported type of findings refinement.
137+
Possible values:
138+
DETECTION_EXCLUSION
139+
- name: updateTime
140+
type: String
141+
description: The timestamp of when the findings refinement was last updated.
142+
output: true

‎mmv1/templates/terraform/examples/chronicle_findings_refinement_basic.tf.tmpl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
resource "google_chronicle_findings_refinement" "{{$.PrimaryResourceId}}" {
2+
provider = google-beta
3+
location = "us"
4+
instance = "{{index $.TestEnvVars "chronicle_id"}}"
5+
display_name = "{{index $.Vars "display_name"}}"
6+
type = "DETECTION_EXCLUSION"
7+
query = "network.dns.response = true"
8+
outcome_filters {
9+
outcome_variable = "risk_score"
10+
outcome_filter_operator = "EQUAL"
11+
outcome_value = "value"
12+
}
13+
}

‎mmv1/templates/terraform/samples/services/chronicle/chronicle_findings_refinement_full.tf.tmpl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
resource "google_chronicle_findings_refinement" "{{$.PrimaryResourceId}}" {
2+
provider = google-beta
3+
location = "us"
4+
instance = "{{index $.TestEnvVars "chronicle_id"}}"
5+
display_name = "{{index $.ResourceIdVars "display_name"}}"
6+
type = "DETECTION_EXCLUSION"
7+
query = "{{index $.Vars "query"}}"
8+
outcome_filters {
9+
outcome_variable = "{{index $.Vars "query"}}"
10+
outcome_filter_operator = "{{index $.Vars "outcome_filter_operator"}}"
11+
outcome_value = "{{index $.Vars "outcome_value"}}"
12+
}
13+
}

0 commit comments

Comments
 (0)