Returns the revisions Resource.
Close httplib2 connections.
Get a configuration by name.
list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
Get a list of configurations that meet the filter criteria.
Retrieves the next page of results.
upsert(parent, body=None, publishTime=None, x__xgafv=None)
Creates or updates a configuration.
close()
Close httplib2 connections.
get(name, x__xgafv=None)
Get a configuration by name.
Args:
name: string, Required. Name of the configuration to get. Format: vaults/{vault}/configurations/{configuration} (required)
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
Returns:
An object of the form:
{ # A configuration represents a behavior an engine should follow when producing new findings.
"audit": { # Tracks basic CRUD facts. # Output only. Audit information for the configuration.
"createTime": "A String", # Output only. Time of creation.
"creator": "A String", # Output only. Agent that created or updated the record, could be a UserId or a JobId.
"updateTime": "A String", # Output only. Time of creation or last update.
"updater": "A String", # Output only. Agent that last updated the record, could be a UserId or a JobId.
},
"description": "A String", # Optional. A description of the configuration.
"detail": { # Wrapper class that contains the union struct for all the various configuration detail specific classes. # Required. Domain specific details for the configuration.
"assetDiscovery": { # Customer defined Configuration for asset discovery. # Asset Discovery detail config.
"lastScanCompleteTime": "A String", # Output only. Timestamp of the last scan completed. This field is set by the system and cannot be modified by the user.
"lastScanStartTime": "A String", # Output only. Timestamp of the last scan started - used for scheduling the next scan. This field is set by the system and cannot be modified by the user.
"scanFrequency": "A String", # Required. Frequency at which the scheduled discovery scan should be run. If not specified, the default frequency is DAILY.
"scopeExclusionAssets": [ # Optional. Seed assets that are out of scope for the scheduled discovery scan.
{ # Seed assets for asset discovery.
"seedType": "A String", # Required. Type of the seed asset.
"seedValue": "A String", # Required. Value for the seed asset. Could be an IP address, network service, email addresses, etc.
},
],
"seedAssets": [ # Required. Seed assets for the scheduled discovery scan. At least one seed asset is required.
{ # Seed assets for asset discovery.
"seedType": "A String", # Required. Type of the seed asset.
"seedValue": "A String", # Required. Value for the seed asset. Could be an IP address, network service, email addresses, etc.
},
],
"workflow": "A String", # Required. Workflow to be used for the scheduled discovery scan. If not specified, the default workflow is EXTERNAL_DISCOVERY.
},
"customerProfile": { # CustomerProfileConfig is the configuration for the customer profile. # Customer Profile detail config.
"citations": [ # Optional. Citations for the organization profile.
{ # Citation information for the customer profile.
"citationId": "A String", # Required. The citation id for the citation. Should be unique within the profile.
"document": "A String", # Required. The name of the document the citation is from.
"retrievalTime": "A String", # The time the citation was retrieved.
"source": "A String", # Required. The source of the citation.
"uri": "A String", # Optional. The url of the citation.
},
],
"contactInfo": [ # Optional. Contact information for the organization.
{ # Contact information for the customer profile.
"address": "A String", # The address of the contact.
"citationIds": [ # Optional. The citation ids for the contact information.
"A String",
],
"email": "A String", # The email address of the contact.
"label": "A String", # Optional. The name of the contact.
"other": "A String", # The other contact information.
"phone": "A String", # The phone number of the contact.
},
],
"executives": [ # Optional. Executives of the organization.
{ # Person information for the customer profile.
"citationIds": [ # Optional. The citation ids for the person.
"A String",
],
"name": "A String", # Required. The name of the person.
"title": "A String", # Optional. The title of the person.
},
],
"industries": [ # Optional. The industries the organization is involved in.
{ # Industry information for the customer profile.
"citationIds": [ # Optional. The citation ids for the industry.
"A String",
],
"industry": "A String", # Required. The name of the industry.
},
],
"locations": [ # Optional. Locations the organization is present or conducts business in.
{ # Location information for the customer profile.
"address": "A String", # Required. The address of the location.
"brand": "A String", # Required. The brand of the location.
"citationIds": [ # Optional. The citation ids for the location.
"A String",
],
"facilityType": "A String", # Optional. The type of location.
},
],
"org": "A String", # Required. The name of the organization.
"orgSummary": "A String", # Optional. A summary of the organization.
"parentCompanies": [ # Optional. The parent companies of the organization.
{ # Company information for the customer profile.
"citationIds": [ # Optional. The citation ids for the company.
"A String",
],
"company": "A String", # Required. The name of the company.
},
],
"products": [ # Optional. Product information for the organization.
{ # Product information for the customer profile.
"brand": "A String", # Required. The brand of the product.
"citationIds": [ # Optional. The citation ids for the product.
"A String",
],
"product": "A String", # Required. The name of the product.
},
],
"securityConsiderations": { # Security considerations for the customer profile. # Optional. Security considerations for the organization.
"considerations": [ # Optional. A series of considerations for the security of the organization, such as "high risk of compromise" or "vulnerable to cyberbullying".
"A String",
],
"note": "A String", # Optional. A note about the security considerations.
},
"summary": { # A summarized version of the customer profile. Generated by the backend. # Optional. A summarized version of the customer profile.
"areaServed": { # A string with citation ids. # Optional. The area the customer serves.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"brands": { # A string with citation ids. # Optional. A narrative summary of brands.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"entityType": { # A string with citation ids. # Optional. The entity type of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"founded": { # A string with citation ids. # Optional. The date the customer was founded.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"headquarters": { # A string with citation ids. # Optional. The headquarters of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"industry": { # A string with citation ids. # Optional. The industry the customer is in.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"keyPeopleSummary": { # A string with citation ids. # Optional. A narrative summary of key people.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"parentCompany": { # A string with citation ids. # Optional. The parent company of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"primaryWebsite": { # A string with citation ids. # Optional. The primary website of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"productsSummary": { # A string with citation ids. # Optional. A narrative summary of products.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"servicesSummary": { # A string with citation ids. # Optional. A narrative summary of services.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"title": { # A string with citation ids. # Optional. The official name of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
},
"technologyPresence": "A String", # Optional. Technology presence of the organization.
"webPresences": [ # Optional. Web presence of the organization.
{ # Web presence information for the customer profile.
"citationIds": [ # Optional. The citation ids for the web presence.
"A String",
],
"domain": "A String", # Required. The domain name of the web presence.
},
],
},
"detailType": "A String", # Output only. Name of the detail type. Will be set by the server during creation to the name of the field that is set in the detail union.
"domainMonitoring": { # Any account-level configuration options will go here. # Domain Monitoring detail config.
"domains": [ # The domains to use as "seeds" for Suspicious Domain Monitoring.
{ # A Domain Monitoring "domain"
"domain": "A String", # The domain name to match against.
},
],
},
"initialAccessBroker": { # InitialAccessBrokerConfig is specific to Initial Access Broker (IAB) matching scenarios. # Initial Access Broker (IAB) detail config.
"entityProfile": { # EntityProfile represents the structured profile of a customer entity, containing key identifiers and descriptive attributes optimized for contextual matching against threat intelligence, particularly Initial Access Broker (IAB) offerings. # Represents the comprehensive profile of the customer entity used for matching.
"countries": [ # Optional. List of specific countries of operation. Purpose: Essential for matching geographically targeted threats (e.g., actor specifies victims in 'DE'). Use ISO 3166-1 alpha-2 codes (e.g., "US", "GB", "JP", "DE").
"A String",
],
"domains": [ # Required. List of primary internet domain names associated with the entity. Purpose: Crucial for explicit matching against domains mentioned in threat intel and can inform semantic matching. Must contain at least one domain. Example: ["acme.com", "acme.co.uk"]
"A String",
],
"industries": [ # Optional. List of primary industry sectors the entity operates within. Purpose: Crucial for matching industry-specific threats and understanding attacker motivation. Use standardized GTI Industry Classification values. Example: ["Technology", "Financial Services", "Healthcare"]
"A String",
],
"name": "A String", # Required. Canonical name of the entity (e.g., the legal company name). Purpose: Primary identifier for the customer.
"operationalAreas": [ # Optional. Specific geographic areas of *significant* operational concentration or strategic importance below the country level, if clearly identifiable and relevant. Purpose: Useful for highly localized threats, less commonly populated than `countries`. Example: ["Silicon Valley", "Frankfurt am Main Metropolitan Region"]
"A String",
],
"profileSummary": "A String", # Required. A concise, machine-generated (e.g., LLM) or human-curated summary of the entity. Purpose: Captures the semantic essence for embedding generation and similarity matching. Should synthesize key aspects like core business, scale, and market. Example: "Acme Corporation is a large, US-based multinational conglomerate operating..."
"regions": [ # Optional. List of primary geopolitical regions where the entity has significant operations. Purpose: Filters geographically relevant threats. Use standardized names or codes where possible (e.g., "North America", "EMEA", "APAC", UN M49 codes).
"A String",
],
"subIndustries": [ # Optional. List of more granular sub-industries, if applicable and known. Purpose: Provides finer-grained context for more specific threat matching. Should align with GTI classifications if possible. Example: ["Semiconductors", "Cloud Computing Services", "Investment Banking"]
"A String",
],
},
},
"technologyWatchlist": { # TechnologyWatchListConfig is the configuration for the technology watchlist. # Technology Watchlist detail config.
"alertThreshold": { # TechnologyWatchListAlertThreshold contains the thresholds for alerting. # Optional. Alert thresholds to effectively reduce noise.
"cvssScoreMinimum": 3.14, # Optional. The minimum cvss V3 score for the alert. Ex: 7.0. Valid range is [0.0, 10.0].
"epssScoreMinimum": 3.14, # Optional. The minimum epss score for the alert. Ex: 0.8. Valid range is [0.0, 1.0].
"exploitationStates": [ # Optional. The exploitation states of the alert.
"A String",
],
"priorityMinimum": "A String", # Optional. The minimum priority for the alert.
},
"technologies": [ # Optional. List of vendor, technology or cpe fingerprint. example: Microsoft office 360 Apache Server 3.5 cpe:2.3:a:microsoft:outlook:*:*:*:*:*:*:*:*
"A String",
],
},
},
"displayName": "A String", # Output only. Human readable name for the configuration.
"name": "A String", # Identifier. Server generated name for the configuration. format is vaults/{vault}/configurations/{configuration}
"provider": "A String", # Required. Name of the service that provides the configuration.
"state": "A String", # Optional. State of the configuration.
"version": "A String", # Optional. A user-manipulatable version. Does not adhere to a specific format
}
list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)
Get a list of configurations that meet the filter criteria.
Args:
parent: string, Required. Parent of the configuration. Format: vaults/{vault} (required)
filter: string, Optional. Filter criteria.
orderBy: string, Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2".
pageSize: integer, Optional. Page size.
pageToken: string, Optional. Page token.
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
Returns:
An object of the form:
{ # Response message for ListConfigurations.
"configurations": [ # List of configurations.
{ # A configuration represents a behavior an engine should follow when producing new findings.
"audit": { # Tracks basic CRUD facts. # Output only. Audit information for the configuration.
"createTime": "A String", # Output only. Time of creation.
"creator": "A String", # Output only. Agent that created or updated the record, could be a UserId or a JobId.
"updateTime": "A String", # Output only. Time of creation or last update.
"updater": "A String", # Output only. Agent that last updated the record, could be a UserId or a JobId.
},
"description": "A String", # Optional. A description of the configuration.
"detail": { # Wrapper class that contains the union struct for all the various configuration detail specific classes. # Required. Domain specific details for the configuration.
"assetDiscovery": { # Customer defined Configuration for asset discovery. # Asset Discovery detail config.
"lastScanCompleteTime": "A String", # Output only. Timestamp of the last scan completed. This field is set by the system and cannot be modified by the user.
"lastScanStartTime": "A String", # Output only. Timestamp of the last scan started - used for scheduling the next scan. This field is set by the system and cannot be modified by the user.
"scanFrequency": "A String", # Required. Frequency at which the scheduled discovery scan should be run. If not specified, the default frequency is DAILY.
"scopeExclusionAssets": [ # Optional. Seed assets that are out of scope for the scheduled discovery scan.
{ # Seed assets for asset discovery.
"seedType": "A String", # Required. Type of the seed asset.
"seedValue": "A String", # Required. Value for the seed asset. Could be an IP address, network service, email addresses, etc.
},
],
"seedAssets": [ # Required. Seed assets for the scheduled discovery scan. At least one seed asset is required.
{ # Seed assets for asset discovery.
"seedType": "A String", # Required. Type of the seed asset.
"seedValue": "A String", # Required. Value for the seed asset. Could be an IP address, network service, email addresses, etc.
},
],
"workflow": "A String", # Required. Workflow to be used for the scheduled discovery scan. If not specified, the default workflow is EXTERNAL_DISCOVERY.
},
"customerProfile": { # CustomerProfileConfig is the configuration for the customer profile. # Customer Profile detail config.
"citations": [ # Optional. Citations for the organization profile.
{ # Citation information for the customer profile.
"citationId": "A String", # Required. The citation id for the citation. Should be unique within the profile.
"document": "A String", # Required. The name of the document the citation is from.
"retrievalTime": "A String", # The time the citation was retrieved.
"source": "A String", # Required. The source of the citation.
"uri": "A String", # Optional. The url of the citation.
},
],
"contactInfo": [ # Optional. Contact information for the organization.
{ # Contact information for the customer profile.
"address": "A String", # The address of the contact.
"citationIds": [ # Optional. The citation ids for the contact information.
"A String",
],
"email": "A String", # The email address of the contact.
"label": "A String", # Optional. The name of the contact.
"other": "A String", # The other contact information.
"phone": "A String", # The phone number of the contact.
},
],
"executives": [ # Optional. Executives of the organization.
{ # Person information for the customer profile.
"citationIds": [ # Optional. The citation ids for the person.
"A String",
],
"name": "A String", # Required. The name of the person.
"title": "A String", # Optional. The title of the person.
},
],
"industries": [ # Optional. The industries the organization is involved in.
{ # Industry information for the customer profile.
"citationIds": [ # Optional. The citation ids for the industry.
"A String",
],
"industry": "A String", # Required. The name of the industry.
},
],
"locations": [ # Optional. Locations the organization is present or conducts business in.
{ # Location information for the customer profile.
"address": "A String", # Required. The address of the location.
"brand": "A String", # Required. The brand of the location.
"citationIds": [ # Optional. The citation ids for the location.
"A String",
],
"facilityType": "A String", # Optional. The type of location.
},
],
"org": "A String", # Required. The name of the organization.
"orgSummary": "A String", # Optional. A summary of the organization.
"parentCompanies": [ # Optional. The parent companies of the organization.
{ # Company information for the customer profile.
"citationIds": [ # Optional. The citation ids for the company.
"A String",
],
"company": "A String", # Required. The name of the company.
},
],
"products": [ # Optional. Product information for the organization.
{ # Product information for the customer profile.
"brand": "A String", # Required. The brand of the product.
"citationIds": [ # Optional. The citation ids for the product.
"A String",
],
"product": "A String", # Required. The name of the product.
},
],
"securityConsiderations": { # Security considerations for the customer profile. # Optional. Security considerations for the organization.
"considerations": [ # Optional. A series of considerations for the security of the organization, such as "high risk of compromise" or "vulnerable to cyberbullying".
"A String",
],
"note": "A String", # Optional. A note about the security considerations.
},
"summary": { # A summarized version of the customer profile. Generated by the backend. # Optional. A summarized version of the customer profile.
"areaServed": { # A string with citation ids. # Optional. The area the customer serves.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"brands": { # A string with citation ids. # Optional. A narrative summary of brands.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"entityType": { # A string with citation ids. # Optional. The entity type of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"founded": { # A string with citation ids. # Optional. The date the customer was founded.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"headquarters": { # A string with citation ids. # Optional. The headquarters of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"industry": { # A string with citation ids. # Optional. The industry the customer is in.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"keyPeopleSummary": { # A string with citation ids. # Optional. A narrative summary of key people.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"parentCompany": { # A string with citation ids. # Optional. The parent company of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"primaryWebsite": { # A string with citation ids. # Optional. The primary website of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"productsSummary": { # A string with citation ids. # Optional. A narrative summary of products.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"servicesSummary": { # A string with citation ids. # Optional. A narrative summary of services.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"title": { # A string with citation ids. # Optional. The official name of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
},
"technologyPresence": "A String", # Optional. Technology presence of the organization.
"webPresences": [ # Optional. Web presence of the organization.
{ # Web presence information for the customer profile.
"citationIds": [ # Optional. The citation ids for the web presence.
"A String",
],
"domain": "A String", # Required. The domain name of the web presence.
},
],
},
"detailType": "A String", # Output only. Name of the detail type. Will be set by the server during creation to the name of the field that is set in the detail union.
"domainMonitoring": { # Any account-level configuration options will go here. # Domain Monitoring detail config.
"domains": [ # The domains to use as "seeds" for Suspicious Domain Monitoring.
{ # A Domain Monitoring "domain"
"domain": "A String", # The domain name to match against.
},
],
},
"initialAccessBroker": { # InitialAccessBrokerConfig is specific to Initial Access Broker (IAB) matching scenarios. # Initial Access Broker (IAB) detail config.
"entityProfile": { # EntityProfile represents the structured profile of a customer entity, containing key identifiers and descriptive attributes optimized for contextual matching against threat intelligence, particularly Initial Access Broker (IAB) offerings. # Represents the comprehensive profile of the customer entity used for matching.
"countries": [ # Optional. List of specific countries of operation. Purpose: Essential for matching geographically targeted threats (e.g., actor specifies victims in 'DE'). Use ISO 3166-1 alpha-2 codes (e.g., "US", "GB", "JP", "DE").
"A String",
],
"domains": [ # Required. List of primary internet domain names associated with the entity. Purpose: Crucial for explicit matching against domains mentioned in threat intel and can inform semantic matching. Must contain at least one domain. Example: ["acme.com", "acme.co.uk"]
"A String",
],
"industries": [ # Optional. List of primary industry sectors the entity operates within. Purpose: Crucial for matching industry-specific threats and understanding attacker motivation. Use standardized GTI Industry Classification values. Example: ["Technology", "Financial Services", "Healthcare"]
"A String",
],
"name": "A String", # Required. Canonical name of the entity (e.g., the legal company name). Purpose: Primary identifier for the customer.
"operationalAreas": [ # Optional. Specific geographic areas of *significant* operational concentration or strategic importance below the country level, if clearly identifiable and relevant. Purpose: Useful for highly localized threats, less commonly populated than `countries`. Example: ["Silicon Valley", "Frankfurt am Main Metropolitan Region"]
"A String",
],
"profileSummary": "A String", # Required. A concise, machine-generated (e.g., LLM) or human-curated summary of the entity. Purpose: Captures the semantic essence for embedding generation and similarity matching. Should synthesize key aspects like core business, scale, and market. Example: "Acme Corporation is a large, US-based multinational conglomerate operating..."
"regions": [ # Optional. List of primary geopolitical regions where the entity has significant operations. Purpose: Filters geographically relevant threats. Use standardized names or codes where possible (e.g., "North America", "EMEA", "APAC", UN M49 codes).
"A String",
],
"subIndustries": [ # Optional. List of more granular sub-industries, if applicable and known. Purpose: Provides finer-grained context for more specific threat matching. Should align with GTI classifications if possible. Example: ["Semiconductors", "Cloud Computing Services", "Investment Banking"]
"A String",
],
},
},
"technologyWatchlist": { # TechnologyWatchListConfig is the configuration for the technology watchlist. # Technology Watchlist detail config.
"alertThreshold": { # TechnologyWatchListAlertThreshold contains the thresholds for alerting. # Optional. Alert thresholds to effectively reduce noise.
"cvssScoreMinimum": 3.14, # Optional. The minimum cvss V3 score for the alert. Ex: 7.0. Valid range is [0.0, 10.0].
"epssScoreMinimum": 3.14, # Optional. The minimum epss score for the alert. Ex: 0.8. Valid range is [0.0, 1.0].
"exploitationStates": [ # Optional. The exploitation states of the alert.
"A String",
],
"priorityMinimum": "A String", # Optional. The minimum priority for the alert.
},
"technologies": [ # Optional. List of vendor, technology or cpe fingerprint. example: Microsoft office 360 Apache Server 3.5 cpe:2.3:a:microsoft:outlook:*:*:*:*:*:*:*:*
"A String",
],
},
},
"displayName": "A String", # Output only. Human readable name for the configuration.
"name": "A String", # Identifier. Server generated name for the configuration. format is vaults/{vault}/configurations/{configuration}
"provider": "A String", # Required. Name of the service that provides the configuration.
"state": "A String", # Optional. State of the configuration.
"version": "A String", # Optional. A user-manipulatable version. Does not adhere to a specific format
},
],
"nextPageToken": "A String", # Page token.
}
list_next()
Retrieves the next page of results.
Args:
previous_request: The request for the previous page. (required)
previous_response: The response from the request for the previous page. (required)
Returns:
A request object that you can call 'execute()' on to request the next
page. Returns None if there are no more items in the collection.
upsert(parent, body=None, publishTime=None, x__xgafv=None)
Creates or updates a configuration.
Args:
parent: string, Required. Parent of the configuration. (required)
body: object, The request body.
The object takes the form of:
{ # A configuration represents a behavior an engine should follow when producing new findings.
"audit": { # Tracks basic CRUD facts. # Output only. Audit information for the configuration.
"createTime": "A String", # Output only. Time of creation.
"creator": "A String", # Output only. Agent that created or updated the record, could be a UserId or a JobId.
"updateTime": "A String", # Output only. Time of creation or last update.
"updater": "A String", # Output only. Agent that last updated the record, could be a UserId or a JobId.
},
"description": "A String", # Optional. A description of the configuration.
"detail": { # Wrapper class that contains the union struct for all the various configuration detail specific classes. # Required. Domain specific details for the configuration.
"assetDiscovery": { # Customer defined Configuration for asset discovery. # Asset Discovery detail config.
"lastScanCompleteTime": "A String", # Output only. Timestamp of the last scan completed. This field is set by the system and cannot be modified by the user.
"lastScanStartTime": "A String", # Output only. Timestamp of the last scan started - used for scheduling the next scan. This field is set by the system and cannot be modified by the user.
"scanFrequency": "A String", # Required. Frequency at which the scheduled discovery scan should be run. If not specified, the default frequency is DAILY.
"scopeExclusionAssets": [ # Optional. Seed assets that are out of scope for the scheduled discovery scan.
{ # Seed assets for asset discovery.
"seedType": "A String", # Required. Type of the seed asset.
"seedValue": "A String", # Required. Value for the seed asset. Could be an IP address, network service, email addresses, etc.
},
],
"seedAssets": [ # Required. Seed assets for the scheduled discovery scan. At least one seed asset is required.
{ # Seed assets for asset discovery.
"seedType": "A String", # Required. Type of the seed asset.
"seedValue": "A String", # Required. Value for the seed asset. Could be an IP address, network service, email addresses, etc.
},
],
"workflow": "A String", # Required. Workflow to be used for the scheduled discovery scan. If not specified, the default workflow is EXTERNAL_DISCOVERY.
},
"customerProfile": { # CustomerProfileConfig is the configuration for the customer profile. # Customer Profile detail config.
"citations": [ # Optional. Citations for the organization profile.
{ # Citation information for the customer profile.
"citationId": "A String", # Required. The citation id for the citation. Should be unique within the profile.
"document": "A String", # Required. The name of the document the citation is from.
"retrievalTime": "A String", # The time the citation was retrieved.
"source": "A String", # Required. The source of the citation.
"uri": "A String", # Optional. The url of the citation.
},
],
"contactInfo": [ # Optional. Contact information for the organization.
{ # Contact information for the customer profile.
"address": "A String", # The address of the contact.
"citationIds": [ # Optional. The citation ids for the contact information.
"A String",
],
"email": "A String", # The email address of the contact.
"label": "A String", # Optional. The name of the contact.
"other": "A String", # The other contact information.
"phone": "A String", # The phone number of the contact.
},
],
"executives": [ # Optional. Executives of the organization.
{ # Person information for the customer profile.
"citationIds": [ # Optional. The citation ids for the person.
"A String",
],
"name": "A String", # Required. The name of the person.
"title": "A String", # Optional. The title of the person.
},
],
"industries": [ # Optional. The industries the organization is involved in.
{ # Industry information for the customer profile.
"citationIds": [ # Optional. The citation ids for the industry.
"A String",
],
"industry": "A String", # Required. The name of the industry.
},
],
"locations": [ # Optional. Locations the organization is present or conducts business in.
{ # Location information for the customer profile.
"address": "A String", # Required. The address of the location.
"brand": "A String", # Required. The brand of the location.
"citationIds": [ # Optional. The citation ids for the location.
"A String",
],
"facilityType": "A String", # Optional. The type of location.
},
],
"org": "A String", # Required. The name of the organization.
"orgSummary": "A String", # Optional. A summary of the organization.
"parentCompanies": [ # Optional. The parent companies of the organization.
{ # Company information for the customer profile.
"citationIds": [ # Optional. The citation ids for the company.
"A String",
],
"company": "A String", # Required. The name of the company.
},
],
"products": [ # Optional. Product information for the organization.
{ # Product information for the customer profile.
"brand": "A String", # Required. The brand of the product.
"citationIds": [ # Optional. The citation ids for the product.
"A String",
],
"product": "A String", # Required. The name of the product.
},
],
"securityConsiderations": { # Security considerations for the customer profile. # Optional. Security considerations for the organization.
"considerations": [ # Optional. A series of considerations for the security of the organization, such as "high risk of compromise" or "vulnerable to cyberbullying".
"A String",
],
"note": "A String", # Optional. A note about the security considerations.
},
"summary": { # A summarized version of the customer profile. Generated by the backend. # Optional. A summarized version of the customer profile.
"areaServed": { # A string with citation ids. # Optional. The area the customer serves.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"brands": { # A string with citation ids. # Optional. A narrative summary of brands.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"entityType": { # A string with citation ids. # Optional. The entity type of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"founded": { # A string with citation ids. # Optional. The date the customer was founded.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"headquarters": { # A string with citation ids. # Optional. The headquarters of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"industry": { # A string with citation ids. # Optional. The industry the customer is in.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"keyPeopleSummary": { # A string with citation ids. # Optional. A narrative summary of key people.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"parentCompany": { # A string with citation ids. # Optional. The parent company of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"primaryWebsite": { # A string with citation ids. # Optional. The primary website of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"productsSummary": { # A string with citation ids. # Optional. A narrative summary of products.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"servicesSummary": { # A string with citation ids. # Optional. A narrative summary of services.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
"title": { # A string with citation ids. # Optional. The official name of the customer.
"citationIds": [ # Optional. The citation ids for the string.
"A String",
],
"value": "A String", # Required. The value of the string.
},
},
"technologyPresence": "A String", # Optional. Technology presence of the organization.
"webPresences": [ # Optional. Web presence of the organization.
{ # Web presence information for the customer profile.
"citationIds": [ # Optional. The citation ids for the web presence.
"A String",
],
"domain": "A String", # Required. The domain name of the web presence.
},
],
},
"detailType": "A String", # Output only. Name of the detail type. Will be set by the server during creation to the name of the field that is set in the detail union.
"domainMonitoring": { # Any account-level configuration options will go here. # Domain Monitoring detail config.
"domains": [ # The domains to use as "seeds" for Suspicious Domain Monitoring.
{ # A Domain Monitoring "domain"
"domain": "A String", # The domain name to match against.
},
],
},
"initialAccessBroker": { # InitialAccessBrokerConfig is specific to Initial Access Broker (IAB) matching scenarios. # Initial Access Broker (IAB) detail config.
"entityProfile": { # EntityProfile represents the structured profile of a customer entity, containing key identifiers and descriptive attributes optimized for contextual matching against threat intelligence, particularly Initial Access Broker (IAB) offerings. # Represents the comprehensive profile of the customer entity used for matching.
"countries": [ # Optional. List of specific countries of operation. Purpose: Essential for matching geographically targeted threats (e.g., actor specifies victims in 'DE'). Use ISO 3166-1 alpha-2 codes (e.g., "US", "GB", "JP", "DE").
"A String",
],
"domains": [ # Required. List of primary internet domain names associated with the entity. Purpose: Crucial for explicit matching against domains mentioned in threat intel and can inform semantic matching. Must contain at least one domain. Example: ["acme.com", "acme.co.uk"]
"A String",
],
"industries": [ # Optional. List of primary industry sectors the entity operates within. Purpose: Crucial for matching industry-specific threats and understanding attacker motivation. Use standardized GTI Industry Classification values. Example: ["Technology", "Financial Services", "Healthcare"]
"A String",
],
"name": "A String", # Required. Canonical name of the entity (e.g., the legal company name). Purpose: Primary identifier for the customer.
"operationalAreas": [ # Optional. Specific geographic areas of *significant* operational concentration or strategic importance below the country level, if clearly identifiable and relevant. Purpose: Useful for highly localized threats, less commonly populated than `countries`. Example: ["Silicon Valley", "Frankfurt am Main Metropolitan Region"]
"A String",
],
"profileSummary": "A String", # Required. A concise, machine-generated (e.g., LLM) or human-curated summary of the entity. Purpose: Captures the semantic essence for embedding generation and similarity matching. Should synthesize key aspects like core business, scale, and market. Example: "Acme Corporation is a large, US-based multinational conglomerate operating..."
"regions": [ # Optional. List of primary geopolitical regions where the entity has significant operations. Purpose: Filters geographically relevant threats. Use standardized names or codes where possible (e.g., "North America", "EMEA", "APAC", UN M49 codes).
"A String",
],
"subIndustries": [ # Optional. List of more granular sub-industries, if applicable and known. Purpose: Provides finer-grained context for more specific threat matching. Should align with GTI classifications if possible. Example: ["Semiconductors", "Cloud Computing Services", "Investment Banking"]
"A String",
],
},
},
"technologyWatchlist": { # TechnologyWatchListConfig is the configuration for the technology watchlist. # Technology Watchlist detail config.
"alertThreshold": { # TechnologyWatchListAlertThreshold contains the thresholds for alerting. # Optional. Alert thresholds to effectively reduce noise.
"cvssScoreMinimum": 3.14, # Optional. The minimum cvss V3 score for the alert. Ex: 7.0. Valid range is [0.0, 10.0].
"epssScoreMinimum": 3.14, # Optional. The minimum epss score for the alert. Ex: 0.8. Valid range is [0.0, 1.0].
"exploitationStates": [ # Optional. The exploitation states of the alert.
"A String",
],
"priorityMinimum": "A String", # Optional. The minimum priority for the alert.
},
"technologies": [ # Optional. List of vendor, technology or cpe fingerprint. example: Microsoft office 360 Apache Server 3.5 cpe:2.3:a:microsoft:outlook:*:*:*:*:*:*:*:*
"A String",
],
},
},
"displayName": "A String", # Output only. Human readable name for the configuration.
"name": "A String", # Identifier. Server generated name for the configuration. format is vaults/{vault}/configurations/{configuration}
"provider": "A String", # Required. Name of the service that provides the configuration.
"state": "A String", # Optional. State of the configuration.
"version": "A String", # Optional. A user-manipulatable version. Does not adhere to a specific format
}
publishTime: string, Optional. Time that the configuration should be considered to have been published. This is an advanced feature used when onboarding and bulk loading data from other systems. Do not set this field without consulting with the API team.
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
Returns:
An object of the form:
{ # Response message for UpsertConfiguration.
"configuration": "A String", # Output only. Created configuration ID with server assigned id.
}