{
  "externalDocs": {
    "description": "Find more info here.",
    "url": "https://docs.cloud.google.com/threatintelligence/"
  },
  "paths": {
    "/v1beta/projects/{project}/alerts/{alert}:getPassword": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "get": {
        "tags": [
          "threatintelligence"
        ],
        "parameters": [
          {
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path",
            "required": true,
            "name": "project",
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "required": true,
            "name": "alert",
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122."
          }
        ],
        "description": "Get the decrypted password of an alert.",
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GetPasswordResponse"
                }
              }
            },
            "description": "Successful operation"
          }
        },
        "operationId": "GetPassword"
      }
    },
    "/v1beta/projects/{project}/alerts/{alert}:benign": {
      "post": {
        "description": "Marks an alert as benign - BENIGN.",
        "parameters": [
          {
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "name": "project",
            "schema": {
              "type": "string"
            },
            "in": "path",
            "required": true
          },
          {
            "name": "alert",
            "in": "path",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122."
          }
        ],
        "tags": [
          "threatintelligence"
        ],
        "responses": {
          "default": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Alert"
                }
              }
            }
          }
        },
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MarkAlertAsBenignRequest"
              }
            }
          },
          "description": "The request body."
        },
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "operationId": "MarkAlertAsBenign"
      },
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ]
    },
    "/v1beta/projects/{project}/findings/{finding}": {
      "get": {
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "operationId": "GetFinding",
        "parameters": [
          {
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "name": "project",
            "in": "path"
          },
          {
            "name": "finding",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path"
          }
        ],
        "tags": [
          "threatintelligence"
        ],
        "description": "Get a finding by name.\nThe `name` field should have the format:\n`projects/{project}/findings/{finding}`",
        "responses": {
          "default": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Finding"
                }
              }
            }
          }
        }
      },
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ]
    },
    "/v1beta/projects/{project}/alerts/{alert}:trackExternally": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "post": {
        "parameters": [
          {
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "schema": {
              "type": "string"
            },
            "in": "path",
            "name": "project"
          },
          {
            "name": "alert",
            "required": true,
            "in": "path",
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122."
          }
        ],
        "description": "Marks an alert as tracked externally - TRACKED_EXTERNALLY.",
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "tags": [
          "threatintelligence"
        ],
        "operationId": "MarkAlertAsTrackedExternally",
        "requestBody": {
          "description": "The request body.",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MarkAlertAsTrackedExternallyRequest"
              }
            }
          }
        },
        "responses": {
          "default": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Alert"
                }
              }
            }
          }
        }
      }
    },
    "/v1beta/projects/{project}/configurations/{configuration}": {
      "get": {
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "parameters": [
          {
            "schema": {
              "type": "string"
            },
            "name": "project",
            "required": true,
            "in": "path",
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122."
          },
          {
            "required": true,
            "name": "configuration",
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path"
          }
        ],
        "tags": [
          "threatintelligence"
        ],
        "description": "Get a configuration by name.",
        "responses": {
          "default": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Configuration"
                }
              }
            }
          }
        },
        "operationId": "GetConfiguration"
      },
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ]
    },
    "/v1beta/projects/{project}/findings:search": {
      "get": {
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SearchFindingsResponse"
                }
              }
            },
            "description": "Successful operation"
          }
        },
        "parameters": [
          {
            "in": "path",
            "required": true,
            "name": "project",
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Optional. Query on what findings will be returned. This supports the same filter\ncriteria as FindingService.ListFindings as well as the following\nrelationship query `has_alert`.\nExample:\n  - `has_alert(\"name=\\\"projects/gti-12345/alerts/alert-12345\\\"\")`",
            "in": "query",
            "schema": {
              "type": "string"
            },
            "name": "query"
          },
          {
            "in": "query",
            "description": "Optional. Order by criteria in the csv format: \"field1,field2 desc\" or\n\"field1,field2\" or \"field1 asc, field2\".",
            "name": "orderBy",
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "pageToken",
            "schema": {
              "type": "string"
            },
            "description": "Optional. Page token."
          },
          {
            "description": "Optional. Page size.",
            "name": "pageSize",
            "in": "query",
            "schema": {
              "type": "integer",
              "format": "int32"
            }
          }
        ],
        "operationId": "SearchFindings",
        "description": "SearchFindings is a more powerful version of ListFindings that\nsupports complex queries like \"findings for alerts\" using functions such as\n`has_alert` in the query string.\nThe `parent` field in SearchFindingsRequest should have the format:\nprojects/{project}\nExample to search for findings for a specific issue:\n`has_alert(\"name=\\\"projects/gti-12345/alerts/alert-12345\\\"\")`",
        "tags": [
          "threatintelligence"
        ],
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ]
      },
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ]
    },
    "/v1beta/projects/{project}/alerts/{alert}:triage": {
      "post": {
        "tags": [
          "threatintelligence"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MarkAlertAsTriagedRequest"
              }
            }
          },
          "description": "The request body."
        },
        "operationId": "MarkAlertAsTriaged",
        "parameters": [
          {
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "required": true,
            "name": "project",
            "in": "path",
            "schema": {
              "type": "string"
            }
          },
          {
            "schema": {
              "type": "string"
            },
            "name": "alert",
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path"
          }
        ],
        "description": "Marks an alert as triaged - TRIAGED.",
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "responses": {
          "default": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Alert"
                }
              }
            }
          }
        }
      },
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ]
    },
    "/v1beta/projects/{project}/alerts/{alert}:read": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "post": {
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Alert"
                }
              }
            },
            "description": "Successful operation"
          }
        },
        "parameters": [
          {
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "name": "project",
            "in": "path"
          },
          {
            "name": "alert",
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "operationId": "MarkAlertAsRead",
        "requestBody": {
          "description": "The request body.",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MarkAlertAsReadRequest"
              }
            }
          }
        },
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "description": "Marks an alert as read - READ.",
        "tags": [
          "threatintelligence"
        ]
      }
    },
    "/v1beta/projects/{project}/configurations": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "get": {
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "operationId": "ListConfigurations",
        "parameters": [
          {
            "name": "project",
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path",
            "required": true
          },
          {
            "in": "query",
            "schema": {
              "type": "string"
            },
            "description": "Optional. Filter criteria.",
            "name": "filter"
          },
          {
            "description": "Optional. Order by criteria in the csv format: \"field1,field2 desc\" or\n\"field1,field2\" or \"field1 asc, field2\".",
            "schema": {
              "type": "string"
            },
            "in": "query",
            "name": "orderBy"
          },
          {
            "description": "Optional. Page token.",
            "name": "pageToken",
            "schema": {
              "type": "string"
            },
            "in": "query"
          },
          {
            "name": "pageSize",
            "in": "query",
            "schema": {
              "format": "int32",
              "type": "integer"
            },
            "description": "Optional. Page size."
          }
        ],
        "description": "Get a list of configurations that meet the filter criteria.",
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListConfigurationsResponse"
                }
              }
            },
            "description": "Successful operation"
          }
        },
        "tags": [
          "threatintelligence"
        ]
      }
    },
    "/v1beta/projects/{project}/configurations:upsert": {
      "post": {
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "parameters": [
          {
            "name": "project",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122."
          },
          {
            "schema": {
              "type": "string",
              "format": "date-time"
            },
            "name": "publishTime",
            "description": "Optional. Time that the configuration should be considered to have been published.\nThis is an advanced feature used when onboarding and bulk loading data from\nother systems. Do not set this field without consulting with the API team.",
            "in": "query"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/Configuration"
              }
            }
          },
          "description": "Required. Configuration we are creating or updating."
        },
        "tags": [
          "threatintelligence"
        ],
        "operationId": "UpsertConfiguration",
        "description": "Creates or updates a configuration.",
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UpsertConfigurationResponse"
                }
              }
            },
            "description": "Successful operation"
          }
        }
      },
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ]
    },
    "/v1beta/projects/{project}/alerts/{alert}:resolve": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "post": {
        "tags": [
          "threatintelligence"
        ],
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Alert"
                }
              }
            },
            "description": "Successful operation"
          }
        },
        "description": "Marks an alert to closed state - RESOLVED.",
        "operationId": "MarkAlertAsResolved",
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "parameters": [
          {
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "schema": {
              "type": "string"
            },
            "in": "path",
            "name": "project"
          },
          {
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "required": true,
            "name": "alert",
            "in": "path"
          }
        ],
        "requestBody": {
          "description": "The request body.",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MarkAlertAsResolvedRequest"
              }
            }
          }
        }
      }
    },
    "/v1beta/projects/{project}/alerts/{alert}/documents/{document}": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "get": {
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "operationId": "GetAlertDocument",
        "tags": [
          "threatintelligence"
        ],
        "parameters": [
          {
            "name": "project",
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "alert",
            "in": "path",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122."
          },
          {
            "required": true,
            "name": "document",
            "in": "path",
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122."
          }
        ],
        "responses": {
          "default": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AlertDocument"
                }
              }
            }
          }
        },
        "description": "Gets a specific document associated with an alert."
      }
    },
    "/v1beta/projects/{project}/alerts/{alert}:notActionable": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "post": {
        "parameters": [
          {
            "in": "path",
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "name": "project",
            "required": true
          },
          {
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path",
            "schema": {
              "type": "string"
            },
            "name": "alert"
          }
        ],
        "description": "Marks an alert as not actionable - NOT_ACTIONABLE.",
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Alert"
                }
              }
            },
            "description": "Successful operation"
          }
        },
        "tags": [
          "threatintelligence"
        ],
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "operationId": "MarkAlertAsNotActionable",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MarkAlertAsNotActionableRequest"
              }
            }
          },
          "description": "The request body."
        }
      }
    },
    "/v1beta/projects/{project}/alerts": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "get": {
        "parameters": [
          {
            "required": true,
            "in": "path",
            "schema": {
              "type": "string"
            },
            "name": "project",
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122."
          },
          {
            "name": "filter",
            "description": "Optional. Filter criteria.\n\nSupported fields for filtering include:\n\n* `audit.create_time`\n* `audit.creator`\n* `audit.update_time`\n* `audit.updater`\n* `detail.data_leak.discovery_document_ids`\n* `detail.data_leak.severity`\n* `detail.detail_type`\n* `detail.initial_access_broker.discovery_document_ids`\n* `detail.initial_access_broker.severity`\n* `detail.insider_threat.discovery_document_ids`\n* `detail.insider_threat.severity`\n* `finding_count`\n* `priority_analysis.priority_level`\n* `relevance_analysis.confidence`\n* `relevance_analysis.relevance_level`\n* `relevance_analysis.relevant`\n* `severity_analysis.severity_level`\n* `state`\n\nExamples:\n\n* `detail.detail_type = \"initial_access_broker\"`\n* `detail.detail_type != \"data_leak\"`\n* `detail.insider_threat.severity = \"HIGH\"`\n* `audit.create_time \u003e= \"2026-04-03T00:00:00Z\" AND audit.create_time \u003c\n\"2026-04-06T00:00:00Z\"`\n* `state = \"NEW\" OR state = \"TRIAGED\"`\n* `severity_analysis.severity_level = \"SEVERITY_LEVEL_CRITICAL\"`",
            "in": "query",
            "schema": {
              "type": "string"
            }
          },
          {
            "schema": {
              "type": "string"
            },
            "description": "Optional. Order by criteria in the csv format: \"field1, field2 desc\" or\n\"field1, field2\" or \"field1 asc, field2\". If a field is specified without\n`asc` or `desc`, ascending order is used by default. Supported fields for\nordering are identical to those supported for filtering.\n\nExamples:\n\n* `audit.create_time desc`\n* `audit.update_time asc`\n* `audit.create_time desc, severity_analysis.severity_level desc`",
            "in": "query",
            "name": "orderBy"
          },
          {
            "in": "query",
            "name": "pageToken",
            "schema": {
              "type": "string"
            },
            "description": "Optional. Page token to retrieve the next page of results."
          },
          {
            "in": "query",
            "description": "Optional. Page size. Default to 100 alerts per page. Maximum is 1000 alerts per page.",
            "name": "pageSize",
            "schema": {
              "type": "integer",
              "format": "int32"
            }
          }
        ],
        "tags": [
          "threatintelligence"
        ],
        "responses": {
          "default": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListAlertsResponse"
                }
              }
            }
          }
        },
        "operationId": "ListAlerts",
        "description": "Get a list of alerts that meet the filter criteria.",
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ]
      }
    },
    "/v1beta/projects/{project}/alerts/{alert}": {
      "get": {
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "tags": [
          "threatintelligence"
        ],
        "operationId": "GetAlert",
        "parameters": [
          {
            "required": true,
            "name": "project",
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path"
          },
          {
            "name": "alert",
            "required": true,
            "schema": {
              "type": "string"
            },
            "in": "path",
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122."
          }
        ],
        "description": "Get an alert by name.",
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Alert"
                }
              }
            },
            "description": "Successful operation"
          }
        }
      },
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ]
    },
    "/v1beta/projects/{project}/configurations/{configuration}/revisions": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "get": {
        "tags": [
          "threatintelligence"
        ],
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "description": "List configuration revisions that meet the filter criteria.",
        "parameters": [
          {
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "required": true,
            "in": "path",
            "name": "project"
          },
          {
            "name": "configuration",
            "in": "path",
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "schema": {
              "type": "string"
            }
          },
          {
            "schema": {
              "type": "string"
            },
            "name": "filter",
            "in": "query",
            "description": "Optional. An AIP-160 filter string"
          },
          {
            "description": "Optional. Specify ordering of response",
            "name": "orderBy",
            "schema": {
              "type": "string"
            },
            "in": "query"
          },
          {
            "schema": {
              "type": "integer",
              "format": "int32"
            },
            "description": "Optional. Page Size",
            "in": "query",
            "name": "pageSize"
          },
          {
            "description": "Optional. A page token provided by the API",
            "schema": {
              "type": "string"
            },
            "in": "query",
            "name": "pageToken"
          }
        ],
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListConfigurationRevisionsResponse"
                }
              }
            },
            "description": "Successful operation"
          }
        },
        "operationId": "ListConfigurationRevisions"
      }
    },
    "/v1beta/projects/{project}/alerts:enumerateFacets": {
      "get": {
        "tags": [
          "threatintelligence"
        ],
        "description": "EnumerateAlertFacets returns the facets and the number of alerts that meet\nthe filter criteria and have that value for each facet.",
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EnumerateAlertFacetsResponse"
                }
              }
            },
            "description": "Successful operation"
          }
        },
        "operationId": "EnumerateAlertFacets",
        "parameters": [
          {
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path",
            "schema": {
              "type": "string"
            },
            "name": "project",
            "required": true
          },
          {
            "name": "filter",
            "description": "Optional. Filter on what alerts will be enumerated.",
            "schema": {
              "type": "string"
            },
            "in": "query"
          }
        ],
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ]
      },
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ]
    },
    "/v1beta/projects/{project}/alerts/{alert}:falsePositive": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "post": {
        "parameters": [
          {
            "in": "path",
            "schema": {
              "type": "string"
            },
            "name": "project",
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "required": true
          },
          {
            "name": "alert",
            "schema": {
              "type": "string"
            },
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path"
          }
        ],
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Alert"
                }
              }
            },
            "description": "Successful operation"
          }
        },
        "operationId": "MarkAlertAsFalsePositive",
        "requestBody": {
          "description": "The request body.",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MarkAlertAsFalsePositiveRequest"
              }
            }
          }
        },
        "tags": [
          "threatintelligence"
        ],
        "description": "Marks an alert as a false positive - FALSE_POSITIVE.",
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ]
      }
    },
    "/v1beta/projects/{project}:generateOrgProfile": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "post": {
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "parameters": [
          {
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path",
            "name": "project",
            "schema": {
              "type": "string"
            },
            "required": true
          }
        ],
        "x-google-lro": "true",
        "description": "Triggers the generation of a Customer Profile for a project.",
        "tags": [
          "threatintelligence"
        ],
        "responses": {
          "default": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GenerateOrgProfileConfigurationOperation"
                }
              }
            }
          }
        },
        "operationId": "GenerateOrgProfileConfiguration",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/GenerateOrgProfileConfigurationRequest"
              }
            }
          },
          "description": "The request body."
        }
      }
    },
    "/v1beta/projects/{project}/findings": {
      "get": {
        "responses": {
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ListFindingsResponse"
                }
              }
            },
            "description": "Successful operation"
          }
        },
        "description": "Get a list of findings that meet the filter criteria.\nThe `parent` field in ListFindingsRequest should have the format:\nprojects/{project}",
        "tags": [
          "threatintelligence"
        ],
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "parameters": [
          {
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "required": true,
            "schema": {
              "type": "string"
            },
            "in": "path",
            "name": "project"
          },
          {
            "schema": {
              "type": "string"
            },
            "in": "query",
            "name": "filter",
            "description": "Optional. Filter criteria."
          },
          {
            "in": "query",
            "schema": {
              "type": "string"
            },
            "description": "Optional. Order by criteria in the csv format: \"field1,field2 desc\" or\n\"field1,field2\" or \"field1 asc, field2\".",
            "name": "orderBy"
          },
          {
            "in": "query",
            "name": "pageToken",
            "description": "Optional. Page token.",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Optional. Page size.",
            "in": "query",
            "name": "pageSize",
            "schema": {
              "type": "integer",
              "format": "int32"
            }
          }
        ],
        "operationId": "ListFindings"
      },
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ]
    },
    "/v1beta/projects/{project}/alerts/{alert}:escalate": {
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ],
      "post": {
        "operationId": "MarkAlertAsEscalated",
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MarkAlertAsEscalatedRequest"
              }
            }
          },
          "description": "The request body."
        },
        "parameters": [
          {
            "name": "project",
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "schema": {
              "type": "string"
            },
            "required": true,
            "in": "path"
          },
          {
            "required": true,
            "name": "alert",
            "schema": {
              "type": "string"
            },
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "in": "path"
          }
        ],
        "tags": [
          "threatintelligence"
        ],
        "responses": {
          "default": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Alert"
                }
              }
            }
          }
        },
        "description": "Marks an alert as escalated - ESCALATED."
      }
    },
    "/v1beta/projects/{project}/alerts/{alert}:duplicate": {
      "post": {
        "operationId": "MarkAlertAsDuplicate",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MarkAlertAsDuplicateRequest"
              }
            }
          },
          "description": "The request body."
        },
        "responses": {
          "default": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Alert"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "in": "path",
            "schema": {
              "type": "string"
            },
            "name": "project",
            "required": true,
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122."
          },
          {
            "description": "Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.",
            "schema": {
              "type": "string"
            },
            "in": "path",
            "required": true,
            "name": "alert"
          }
        ],
        "description": "Marks an alert as a duplicate of another alert. - DUPLICATE.",
        "tags": [
          "threatintelligence"
        ],
        "security": [
          {
            "google_oauth_implicit": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "google_oauth_code": [
              "https://www.googleapis.com/auth/cloud-platform"
            ]
          },
          {
            "bearer_auth": []
          }
        ]
      },
      "parameters": [
        {
          "$ref": "#/components/parameters/alt"
        },
        {
          "$ref": "#/components/parameters/callback"
        },
        {
          "$ref": "#/components/parameters/prettyPrint"
        },
        {
          "$ref": "#/components/parameters/_.xgafv"
        }
      ]
    }
  },
  "openapi": "3.0.3",
  "info": {
    "description": "threatintelligence.googleapis.com API.",
    "version": "v1beta",
    "x-google-revision": "20261106",
    "title": "Threat Intelligence API"
  },
  "components": {
    "securitySchemes": {
      "google_oauth_implicit": {
        "description": "Google Oauth 2.0 implicit authentication flow.",
        "type": "oauth2",
        "flows": {
          "implicit": {
            "authorizationUrl": "https://accounts.google.com/o/oauth2/v2/auth",
            "scopes": {
              "https://www.googleapis.com/auth/cloud-platform": "See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account."
            }
          }
        }
      },
      "google_oauth_code": {
        "type": "oauth2",
        "flows": {
          "authorizationCode": {
            "scopes": {
              "https://www.googleapis.com/auth/cloud-platform": "See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account."
            },
            "authorizationUrl": "https://accounts.google.com/o/oauth2/v2/auth",
            "refreshUrl": "https://oauth2.googleapis.com/token",
            "tokenUrl": "https://oauth2.googleapis.com/token"
          }
        },
        "description": "Google Oauth 2.0 authorizationCode authentication flow."
      },
      "bearer_auth": {
        "description": "Http bearer authentication.",
        "scheme": "bearer",
        "type": "http"
      }
    },
    "parameters": {
      "prettyPrint": {
        "schema": {
          "type": "boolean",
          "default": "true"
        },
        "in": "query",
        "description": "Returns response with indentations and line breaks.",
        "name": "$prettyPrint"
      },
      "alt": {
        "name": "$alt",
        "schema": {
          "x-google-enum-descriptions": [
            "Responses with Content-Type of application/json",
            "Media download with context-dependent Content-Type",
            "Responses with Content-Type of application/x-protobuf"
          ],
          "default": "json",
          "enum": [
            "json",
            "media",
            "proto"
          ],
          "type": "string"
        },
        "description": "Data format for response.",
        "in": "query"
      },
      "callback": {
        "name": "$callback",
        "description": "JSONP",
        "in": "query",
        "schema": {
          "type": "string"
        }
      },
      "_.xgafv": {
        "name": "$.xgafv",
        "description": "V1 error format.",
        "schema": {
          "enum": [
            "1",
            "2"
          ],
          "type": "string",
          "x-google-enum-descriptions": [
            "v1 error format",
            "v2 error format"
          ]
        },
        "in": "query"
      }
    },
    "schemas": {
      "DomainMonitoringDnsDetails": {
        "type": "object",
        "properties": {
          "retrievalTime": {
            "format": "date-time",
            "description": "Optional. The time the DNS details were retrieved.",
            "type": "string"
          },
          "dnsRecords": {
            "items": {
              "$ref": "#/components/schemas/DomainMonitoringDnsRecord"
            },
            "type": "array",
            "description": "Optional. The DNS records of the domain."
          }
        },
        "description": "The DNS details of the domain."
      },
      "MarkAlertAsFalsePositiveRequest": {
        "description": "Request message for MarkAlertAsFalsePositive.",
        "type": "object"
      },
      "DomainMonitoringGtiVerdict": {
        "type": "string",
        "enum": [
          "DOMAIN_MONITORING_GTI_VERDICT_UNSPECIFIED",
          "DOMAIN_MONITORING_GTI_VERDICT_BENIGN",
          "DOMAIN_MONITORING_GTI_VERDICT_UNDETECTED",
          "DOMAIN_MONITORING_GTI_VERDICT_SUSPICIOUS",
          "DOMAIN_MONITORING_GTI_VERDICT_MALICIOUS",
          "DOMAIN_MONITORING_GTI_VERDICT_UNKNOWN"
        ],
        "x-google-enum-descriptions": [
          "Default value. The verdict is not set or unspecified.",
          "Verdict is clean; the entity is considered harmless.",
          "Verdict is undetected; no immediate evidence of malicious intent.",
          "Verdict is suspicious; possible malicious activity detected.",
          "Verdict is malicious; high confidence that the entity poses a threat.",
          "Verdict is not applicable; not able to generate a verdict for this entity."
        ]
      },
      "InitialAccessBrokerFindingDetail": {
        "required": [
          "matchScore",
          "severity"
        ],
        "description": "A detail object for an Initial Access Broker (IAB) finding.",
        "properties": {
          "severity": {
            "type": "string",
            "enum": [
              "SEVERITY_UNSPECIFIED",
              "LOW",
              "MEDIUM",
              "HIGH",
              "CRITICAL"
            ],
            "description": "Required. The severity of the IAB finding. This indicates the potential\nimpact of the threat.",
            "x-google-enum-descriptions": [
              "Default value, should never be set.",
              "Low severity.",
              "Medium severity.",
              "High severity.",
              "Critical severity."
            ]
          },
          "discoveryDocument": {
            "description": "Optional. The discovery document associated with the IAB finding.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DiscoveryDocument"
              }
            ]
          },
          "matchScore": {
            "type": "number",
            "format": "float",
            "description": "Required. Reference to the match score of the IAB finding. This is a float value\nbetween 0 and 1 calculated by the matching engine based on the similarity\nof the document and the user provided configurations."
          },
          "documentId": {
            "type": "string",
            "description": "Optional. Deprecated: Use `discovery_document` instead.\nThe unique identifier of the document that triggered the IAB finding.\nThis ID can be used to retrieve the content of the document for further\nanalysis.",
            "deprecated": true
          }
        },
        "type": "object"
      },
      "DomainMonitoringDnsRecord": {
        "properties": {
          "asnRegionCode": {
            "description": "Optional. The region code of the ASN.\nUse ISO 3166-1 alpha-2 codes.",
            "type": "string"
          },
          "asnHosting": {
            "type": "string",
            "description": "Optional. The ASN hosting the domain."
          },
          "ttl": {
            "type": "integer",
            "description": "Optional. The TTL of the DNS record.",
            "format": "int32"
          },
          "ipRegionCode": {
            "description": "Optional. The region code associated with the resolved IP.\nUse ISO 3166-1 alpha-2 codes.",
            "type": "string"
          },
          "resolvedIp": {
            "description": "Optional. The resolved IP address.",
            "type": "string"
          },
          "type": {
            "type": "string",
            "description": "Optional. The type of the DNS record."
          },
          "recordData": {
            "type": "string",
            "description": "Optional. The value of the DNS record."
          }
        },
        "type": "object",
        "description": "The DNS record of the domain."
      },
      "MarkAlertAsDuplicateRequest": {
        "type": "object",
        "properties": {
          "duplicateOf": {
            "type": "string",
            "description": "Optional. Name of the alert to mark as a duplicate of.\nFormat: projects/{project}/alerts/{alert}"
          }
        },
        "description": "Request message for MarkAlertAsDuplicate."
      },
      "DomainSetting": {
        "properties": {
          "state": {
            "readOnly": true,
            "x-google-enum-descriptions": [
              "Default value. This value is unused.",
              "Verification is pending. The customer needs to add the TXT record.",
              "Verification succeeded."
            ],
            "description": "Output only. The verification state of the domain.",
            "type": "string",
            "enum": [
              "STATE_UNSPECIFIED",
              "PENDING",
              "VERIFIED"
            ]
          },
          "domainMonitoringConfig": {
            "description": "Optional. If not present, Domain Monitoring is enabled.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringFeatureConfig"
              }
            ]
          },
          "domain": {
            "description": "Required. The domain name to match against.",
            "type": "string"
          }
        },
        "type": "object",
        "required": [
          "domain"
        ],
        "description": "Feature settings and toggles for a single specific domain."
      },
      "BaseOperation": {
        "description": "This resource represents a long-running operation that is the result of a\nnetwork API call.",
        "properties": {
          "done": {
            "type": "boolean",
            "description": "If the value is `false`, it means the operation is still in progress.\nIf `true`, the operation is completed, and either `error` or `response` is\navailable."
          },
          "error": {
            "allOf": [
              {
                "$ref": "#/components/schemas/Status"
              }
            ],
            "description": "The error result of the operation in case of failure or cancellation."
          },
          "name": {
            "type": "string",
            "description": "The server-assigned name, which is only unique within the same service that\noriginally returns it. If you use the default HTTP mapping, the\n`name` should be a resource name ending with `operations/{unique_id}`."
          }
        },
        "type": "object"
      },
      "ExploitationState": {
        "type": "string",
        "enum": [
          "EXPLOITATION_STATE_UNSPECIFIED",
          "EXPLOITATION_STATE_NO_KNOWN",
          "EXPLOITATION_STATE_REPORTED",
          "EXPLOITATION_STATE_SUSPECTED",
          "EXPLOITATION_STATE_CONFIRMED",
          "EXPLOITATION_STATE_WIDESPREAD"
        ],
        "x-google-enum-descriptions": [
          "Unspecified exploitation state.",
          "No known exploitation.",
          "Exploitation has been reported.",
          "Exploitation is suspected.",
          "Exploitation is confirmed.",
          "Widespread exploitation."
        ]
      },
      "MarkAlertAsTrackedExternallyRequest": {
        "type": "object",
        "description": "Request message for MarkAlertAsTrackedExternally."
      },
      "CustomThreatScenarioConfig": {
        "properties": {
          "compiledLuceneQuery": {
            "type": "string",
            "description": "Output only. The compiled Lucene query string.",
            "readOnly": true
          },
          "documentCondition": {
            "description": "Required. The condition driving the scenario, stored as a stringified JSON.\nThis is used to query/filter documents.",
            "type": "string"
          },
          "scenarioType": {
            "x-google-enum-descriptions": [
              "Unspecified scenario type.",
              "Data Leaks.",
              "Deep & Dark Web.",
              "Domain Protection.",
              "Ransomware Threats.",
              "Initial Access Broker.",
              "Netblocks and Domain Mentions.",
              "Supply Chain Compromise.",
              "Card Shops.",
              "Custom Monitor (Non-templated legacy monitor)."
            ],
            "description": "Optional. The custom threat scenario type used to create this configuration.",
            "type": "string",
            "enum": [
              "CUSTOM_THREAT_SCENARIO_TYPE_UNSPECIFIED",
              "DATA_LEAKS",
              "DEEP_DARK_WEB",
              "DOMAIN_PROTECTION",
              "RANSOMWARE_THREATS",
              "INITIAL_ACCESS_BROKER",
              "NETBLOCKS_AND_DOMAIN_MENTIONS",
              "SUPPLY_CHAIN_COMPROMISE",
              "CARD_SHOPS",
              "CUSTOM_MONITOR"
            ]
          },
          "documentQuery": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DocumentQuery"
              }
            ],
            "description": "Optional. The query used to match documents."
          },
          "legacyMonitorMetadata": {
            "allOf": [
              {
                "$ref": "#/components/schemas/LegacyMetadata"
              }
            ],
            "readOnly": true,
            "description": "Output only. Legacy metadata associated with this scenario/monitor."
          }
        },
        "description": "CustomThreatScenarioConfig represents a user-defined threat scenario\nconfiguration.",
        "type": "object",
        "required": [
          "documentCondition"
        ]
      },
      "CustomerProfileIndustry": {
        "description": "Industry information for the customer profile.",
        "required": [
          "industry"
        ],
        "type": "object",
        "properties": {
          "citationIds": {
            "type": "array",
            "description": "Optional. The citation ids for the industry.",
            "items": {
              "type": "string"
            }
          },
          "industry": {
            "description": "Required. The name of the industry.",
            "type": "string"
          }
        }
      },
      "PriorityAnalysis": {
        "type": "object",
        "description": "Structured priority analysis for a threat.",
        "properties": {
          "reasoning": {
            "description": "Human-readable explanation from the model, detailing why a particular\nresult is considered to have a certain priority.",
            "type": "string"
          },
          "confidence": {
            "allOf": [
              {
                "$ref": "#/components/schemas/ConfidenceLevel"
              }
            ],
            "description": "The level of confidence in the given verdict."
          },
          "priorityLevel": {
            "allOf": [
              {
                "$ref": "#/components/schemas/PriorityLevel"
              }
            ],
            "description": "The level of Priority."
          }
        }
      },
      "ProductFix": {
        "type": "object",
        "properties": {
          "sourceId": {
            "type": "string",
            "description": "Required. The source ID of the fix. Ex: \"APPSEC-1420\"."
          },
          "publishTime": {
            "format": "date-time",
            "description": "Optional. The published time of the fix.",
            "type": "string"
          },
          "displayName": {
            "description": "Required. The name of the fix. Ex: \"Magento\".",
            "type": "string"
          },
          "uri": {
            "type": "string",
            "description": "Optional. The URI of the fix."
          }
        },
        "description": "Contains details about a product fix.",
        "required": [
          "displayName",
          "sourceId"
        ]
      },
      "Configuration": {
        "type": "object",
        "required": [
          "provider",
          "detail"
        ],
        "description": "A configuration represents a behavior an engine should follow when producing\nnew findings.",
        "properties": {
          "version": {
            "type": "string",
            "description": "Optional. A user-manipulatable version.  Does not adhere to a specific format"
          },
          "name": {
            "x-google-identifier": true,
            "type": "string",
            "description": "Identifier. Server generated name for the configuration.\nformat is projects/{project}/configurations/{configuration}"
          },
          "displayName": {
            "readOnly": true,
            "description": "Output only. Human readable name for the configuration.",
            "type": "string"
          },
          "description": {
            "type": "string",
            "description": "Optional. A description of the configuration."
          },
          "provider": {
            "description": "Required. Name of the service that provides the configuration.",
            "type": "string"
          },
          "audit": {
            "description": "Output only. Audit information for the configuration.",
            "allOf": [
              {
                "$ref": "#/components/schemas/Audit"
              }
            ],
            "readOnly": true
          },
          "state": {
            "type": "string",
            "enum": [
              "STATE_UNSPECIFIED",
              "ENABLED",
              "DISABLED",
              "DEPRECATED"
            ],
            "x-google-enum-descriptions": [
              "Configuration state is unspecified. This is not expected to occur.",
              "Configuration is enabled for the customer.",
              "Configuration is disabled for the customer.",
              "Configuration is deprecated, no new configs are allowed to be created."
            ],
            "description": "Optional. State of the configuration."
          },
          "detail": {
            "allOf": [
              {
                "$ref": "#/components/schemas/ConfigurationDetail"
              }
            ],
            "description": "Required. Domain specific details for the configuration."
          },
          "etag": {
            "type": "string",
            "description": "If included when updating a configuration, this should be set to the\ncurrent etag of the configuration. If the etags do not match, the update\nwill be rejected and an ABORTED error will be returned."
          }
        }
      },
      "Facet": {
        "properties": {
          "maxValue": {
            "type": "string",
            "description": "Max value of the facet stringified based on type. Will be populated and\nformatted the same as min_value."
          },
          "facetCounts": {
            "description": "List of counts for the facet (if categorical).",
            "items": {
              "$ref": "#/components/schemas/FacetCount"
            },
            "type": "array"
          },
          "minValue": {
            "description": "Min value of the facet stringified based on type. This is only populated\nfor facets that have a clear ordering, for types like enum it will be\nleft empty.\nTimestamps will be formatted using RFC3339.",
            "type": "string"
          },
          "facetType": {
            "description": "The type of the facet. Options include \"string\", \"int\", \"float\", \"bool\",\n\"enum\", \"timestamp\", \"user\" and are useful to show the right sort of\nUI controls when building a AIP-160 style filtering string.",
            "type": "string"
          },
          "facet": {
            "description": "Name of the facet. This is also the string that needs to be used in the\nfiltering expression.",
            "type": "string"
          },
          "totalCount": {
            "description": "Total number of records that contain this facet with ANY value.",
            "format": "int64",
            "type": "string"
          }
        },
        "type": "object",
        "description": "Facet represents a sub element of a resource for filtering.\nThe results from this method are used to populate the filterable facets in\nthe UI."
      },
      "TargetTechnologyFindingDetail": {
        "description": "Contains details for a technology watchlist finding.",
        "properties": {
          "vulnerabilityMatch": {
            "allOf": [
              {
                "$ref": "#/components/schemas/VulnerabilityMatch"
              }
            ],
            "description": "Optional. The vulnerability match details."
          }
        },
        "type": "object"
      },
      "DomainMonitoringFindingDetail": {
        "description": "A detailed object for a Domain or URL finding.",
        "type": "object",
        "properties": {
          "threatAttributionDetails": {
            "description": "Optional. The threat attribution details of the domain or URL.",
            "allOf": [
              {
                "$ref": "#/components/schemas/ThreatAttributionDetails"
              }
            ]
          },
          "dnsDetails": {
            "description": "Optional. The DNS details of the domain or URL.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringDnsDetails"
              }
            ]
          },
          "matchedDomain": {
            "description": "Optional. The matched domain.",
            "type": "string"
          },
          "domainDetails": {
            "description": "Details specific to a monitored domain.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringDomainDetails"
              }
            ]
          },
          "relationships": {
            "allOf": [
              {
                "$ref": "#/components/schemas/Relationships"
              }
            ],
            "description": "Optional. The relationships of the domain or URL."
          },
          "infrastructure": {
            "description": "Optional. The infrastructure of the domain or URL.",
            "allOf": [
              {
                "$ref": "#/components/schemas/Infrastructure"
              }
            ]
          },
          "protectedDomain": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringDomainDetails"
              }
            ],
            "description": "The protected domain that triggered the alert."
          },
          "registrationDetails": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DnsRegistrationDetails"
              }
            ],
            "description": "Optional. Extracted WHOIS and DNS registration details."
          },
          "urlDetails": {
            "description": "Details specific to a monitored URL.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringUrlDetails"
              }
            ]
          },
          "whoisDetails": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringWhoIsDetails"
              }
            ],
            "description": "Optional. The whois details of the domain or URL."
          },
          "gtiDetails": {
            "description": "Optional. The GTI details of the domain or URL.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringGtiDetails"
              }
            ]
          },
          "protectedBrand": {
            "description": "The protected brand name that triggered the alert.",
            "type": "string"
          }
        }
      },
      "Relationships": {
        "description": "Related entities and domains observed for the target.",
        "type": "object",
        "properties": {
          "subdomains": {
            "description": "Optional. Subdomains associated with the target domain or URL.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "siblingDomains": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "description": "Optional. Sibling domains sharing the same IP address."
          },
          "relatedUrls": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Optional. Related URLs associated with the domain."
          }
        }
      },
      "AlertTag": {
        "x-google-enum-descriptions": [
          "Default value, should never be set.",
          "Password length is under 8 characters.",
          "Password length is between 8 and 11 characters inclusive.",
          "Password length is 12 or more characters.",
          "Password contains at least one lowercase letter.",
          "Password contains at least one uppercase letter.",
          "Password contains at least one numeric digit.",
          "Password contains at least one special character.",
          "Credential login email domain matches a customer domain.",
          "Credential service domain matches a customer domain."
        ],
        "type": "string",
        "enum": [
          "ALERT_TAG_UNSPECIFIED",
          "ALERT_TAG_PASSWORD_LENGTH_UNDER_8",
          "ALERT_TAG_PASSWORD_LENGTH_8_TO_11",
          "ALERT_TAG_PASSWORD_LENGTH_12_PLUS",
          "ALERT_TAG_PASSWORD_HAS_LOWERCASE",
          "ALERT_TAG_PASSWORD_HAS_UPPERCASE",
          "ALERT_TAG_PASSWORD_HAS_NUMBER",
          "ALERT_TAG_PASSWORD_HAS_SPECIAL",
          "ALERT_TAG_MATCH_LOGIN_EMAIL_DOMAIN",
          "ALERT_TAG_MATCH_SERVICE_DOMAIN"
        ]
      },
      "DomainMonitoringConfig": {
        "properties": {
          "domains": {
            "description": "The domains to use as \"seeds\" for Suspicious Domain Monitoring.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/DomainMonitoringDomain"
            }
          }
        },
        "description": "Any account-level configuration options will go here.",
        "type": "object"
      },
      "MarkAlertAsEscalatedRequest": {
        "description": "Request message for MarkAlertAsEscalated.",
        "type": "object"
      },
      "CustomerProfileWebPresence": {
        "description": "Web presence information for the customer profile.",
        "required": [
          "domain"
        ],
        "type": "object",
        "properties": {
          "citationIds": {
            "description": "Optional. The citation ids for the web presence.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "domain": {
            "description": "Required. The domain name of the web presence.",
            "type": "string"
          }
        }
      },
      "ThreatIntelObjectType": {
        "type": "string",
        "enum": [
          "THREAT_INTEL_OBJECT_TYPE_UNSPECIFIED",
          "THREAT_INTEL_OBJECT_TYPE_THREAT_ACTOR",
          "THREAT_INTEL_OBJECT_TYPE_MALWARE",
          "THREAT_INTEL_OBJECT_TYPE_REPORT",
          "THREAT_INTEL_OBJECT_TYPE_CAMPAIGN",
          "THREAT_INTEL_OBJECT_TYPE_IOC_COLLECTION",
          "THREAT_INTEL_OBJECT_TYPE_SOFTWARE_AND_TOOLKITS",
          "THREAT_INTEL_OBJECT_TYPE_VULNERABILITY"
        ],
        "x-google-enum-descriptions": [
          "Unspecified object type.",
          "Threat actor object type.",
          "Malware object type.",
          "Report object type.",
          "Campaign object type.",
          "IoC Collection object type.",
          "Software and toolkits object type.",
          "Vulnerability object type."
        ]
      },
      "GenerateOrgProfileConfigurationRequest": {
        "type": "object",
        "required": [
          "domain",
          "displayName"
        ],
        "properties": {
          "domain": {
            "description": "Required. The domain of the organization to generate the profile for.",
            "type": "string"
          },
          "displayName": {
            "description": "Required. The display name of the organization to generate the profile for.",
            "type": "string"
          }
        },
        "description": "Request message for GenerateOrgProfileConfiguration."
      },
      "DomainConfiguration": {
        "description": "Configuration holding settings for one or more monitored domains.",
        "type": "object",
        "properties": {
          "domainSettings": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/DomainSetting"
            },
            "description": "Optional. A list of settings for individual domains."
          }
        }
      },
      "CustomerProfileSummary": {
        "properties": {
          "headquarters": {
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ],
            "description": "Optional. The headquarters of the customer."
          },
          "primaryWebsite": {
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ],
            "description": "Optional. The primary website of the customer."
          },
          "founded": {
            "description": "Optional. The date the customer was founded.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ]
          },
          "productsSummary": {
            "description": "Optional. A narrative summary of products.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ]
          },
          "brands": {
            "description": "Optional. A narrative summary of brands.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ]
          },
          "areaServed": {
            "description": "Optional. The area the customer serves.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ]
          },
          "entityType": {
            "description": "Optional. The entity type of the customer.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ]
          },
          "title": {
            "description": "Optional. The official name of the customer.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ]
          },
          "keyPeopleSummary": {
            "description": "Optional. A narrative summary of key people.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ]
          },
          "parentCompany": {
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ],
            "description": "Optional. The parent company of the customer."
          },
          "industry": {
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ],
            "description": "Optional. The industry the customer is in."
          },
          "servicesSummary": {
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileCitedString"
              }
            ],
            "description": "Optional. A narrative summary of services."
          }
        },
        "description": "A summarized version of the customer profile.\nGenerated by the backend.",
        "type": "object"
      },
      "Operation": {
        "description": "This resource represents a long-running operation that is the result of a\nnetwork API call.",
        "allOf": [
          {
            "$ref": "#/components/schemas/BaseOperation"
          },
          {
            "properties": {
              "response": {
                "type": "object",
                "description": "The normal, successful response of the operation.  If the original\nmethod returns no data on success, such as `Delete`, the response is\n`google.protobuf.Empty`.  If the original method is standard\n`Get`/`Create`/`Update`, the response should be the resource.  For other\nmethods, the response should have the type `XxxResponse`, where `Xxx`\nis the original method name.  For example, if the original method name\nis `TakeSnapshot()`, the inferred response type is\n`TakeSnapshotResponse`.",
                "additionalProperties": {
                  "description": "Properties of the object. Contains field @type with type URL."
                }
              },
              "metadata": {
                "description": "Service-specific metadata associated with the operation.  It typically\ncontains progress information and common metadata such as create time.\nSome services might not provide such metadata.  Any method that returns a\nlong-running operation should document the metadata type, if any.",
                "additionalProperties": {
                  "description": "Properties of the object. Contains field @type with type URL."
                },
                "type": "object"
              }
            },
            "type": "object"
          }
        ],
        "type": "object"
      },
      "MarkAlertAsTriagedRequest": {
        "description": "Request message for MarkAlertAsTriaged.",
        "type": "object"
      },
      "DomainMonitoringWhoIsDetails": {
        "description": "The whois details of the domain.",
        "type": "object",
        "properties": {
          "whois": {
            "description": "Optional. The whois details of the domain.",
            "type": "string"
          },
          "retrievalTime": {
            "format": "date-time",
            "type": "string",
            "description": "Optional. The time the whois details were retrieved."
          }
        }
      },
      "CustomerProfileCompany": {
        "properties": {
          "company": {
            "type": "string",
            "description": "Required. The name of the company."
          },
          "citationIds": {
            "type": "array",
            "description": "Optional. The citation ids for the company.",
            "items": {
              "type": "string"
            }
          }
        },
        "required": [
          "company"
        ],
        "type": "object",
        "description": "Company information for the customer profile."
      },
      "DocumentQuery": {
        "type": "object",
        "description": "Represents a query to match documents.",
        "properties": {
          "query": {
            "type": "string",
            "description": "Required. The query string."
          },
          "queryType": {
            "description": "Required. The type of query.",
            "type": "string",
            "enum": [
              "QUERY_TYPE_UNSPECIFIED",
              "JSON",
              "STRING"
            ],
            "x-google-enum-descriptions": [
              "Default value, should never be set.",
              "Structured JSON condition tree built via query builder.",
              "Raw search query string e.g., VTI search syntax."
            ]
          }
        },
        "required": [
          "query",
          "queryType"
        ]
      },
      "TechnologyWatchListConfig": {
        "properties": {
          "alertThreshold": {
            "description": "Optional. Alert thresholds to effectively reduce noise.",
            "allOf": [
              {
                "$ref": "#/components/schemas/TechnologyWatchListAlertThreshold"
              }
            ]
          },
          "technologies": {
            "items": {
              "type": "string"
            },
            "description": "Optional. List of technologies to watch, one per entry, in the form\n`  [version]`, using the vendor and product names from the\nGoogle Threat Intelligence products and fixes section.\nexample:\n `microsoft outlook`\n `apache http_server 2.4.54`\nCPE strings such as `cpe:2.3:a:microsoft:outlook:*:*:*:*:*:*:*:*` are only\nparsed through the Google Threat Intelligence interface and are not\navailable through the API. Send the vendor and product pair instead.",
            "type": "array"
          }
        },
        "description": "TechnologyWatchListConfig is the configuration for the technology watchlist.",
        "type": "object"
      },
      "InitialAccessBrokerAlertDetail": {
        "required": [
          "severity"
        ],
        "properties": {
          "discoveryDocuments": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/DiscoveryDocument"
            },
            "readOnly": true,
            "description": "Output only. New structured metadata payload."
          },
          "discoveryDocumentIds": {
            "type": "array",
            "deprecated": true,
            "items": {
              "type": "string"
            },
            "description": "Optional. Deprecated: Use `discovery_documents` instead.\nArray of ids to accommodate multiple discovery documents."
          },
          "severity": {
            "description": "Required. The severity of the Initial Access Broker (IAB) alert.\nAllowed values are:\n* `LOW`\n* `MEDIUM`\n* `HIGH`\n* `CRITICAL`",
            "type": "string"
          }
        },
        "description": "Captures the specific details of InitialAccessBroker (IAB) alert.",
        "type": "object"
      },
      "AlertDetail": {
        "type": "object",
        "description": "Container for different types of alert details.",
        "properties": {
          "detailType": {
            "readOnly": true,
            "type": "string",
            "description": "Output only. Name of the detail type. Will be set by the server during creation to the\nname of the field that is set in the detail union."
          },
          "dataLeak": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DataLeakAlertDetail"
              }
            ],
            "description": "Data Leak alert detail type."
          },
          "initialAccessBroker": {
            "allOf": [
              {
                "$ref": "#/components/schemas/InitialAccessBrokerAlertDetail"
              }
            ],
            "description": "Initial Access Broker alert detail type."
          },
          "targetTechnology": {
            "description": "Technology Watchlist alert detail type.",
            "allOf": [
              {
                "$ref": "#/components/schemas/TargetTechnologyAlertDetail"
              }
            ]
          },
          "domainMonitoring": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringAlertDetail"
              }
            ],
            "description": "Domain Monitoring alert detail type."
          },
          "insiderThreat": {
            "description": "Insider Threat alert detail type.",
            "allOf": [
              {
                "$ref": "#/components/schemas/InsiderThreatAlertDetail"
              }
            ]
          }
        }
      },
      "Finding": {
        "properties": {
          "severity": {
            "deprecated": true,
            "description": "Optional. Deprecated: Use the `severity_analysis` field instead.\nBase severity score from the finding source.",
            "format": "float",
            "type": "number"
          },
          "audit": {
            "readOnly": true,
            "allOf": [
              {
                "$ref": "#/components/schemas/Audit"
              }
            ],
            "description": "Output only. Audit data about the finding."
          },
          "name": {
            "x-google-identifier": true,
            "description": "Identifier. Server generated name for the finding (leave clear during creation).\nFormat: projects/{project}/findings/{finding}",
            "type": "string"
          },
          "aiSummary": {
            "description": "Optional. AI summary of the finding.",
            "type": "string"
          },
          "severityAnalysis": {
            "allOf": [
              {
                "$ref": "#/components/schemas/SeverityAnalysis"
              }
            ],
            "readOnly": true,
            "description": "Output only. High-Precision Severity Analysis verdict for the finding."
          },
          "detail": {
            "allOf": [
              {
                "$ref": "#/components/schemas/FindingDetail"
              }
            ],
            "description": "Required. Holder of the domain specific details of the finding."
          },
          "reoccurrenceTimes": {
            "items": {
              "type": "string",
              "format": "date-time"
            },
            "type": "array",
            "description": "Output only. When identical finding (same labels and same details) has re-occurred.",
            "readOnly": true
          },
          "configurations": {
            "items": {
              "type": "string"
            },
            "description": "Optional. Configuration names that are bound to this finding.",
            "type": "array"
          },
          "provider": {
            "type": "string",
            "description": "Required. Logical source of this finding (name of the sub-engine)."
          },
          "relevanceAnalysis": {
            "readOnly": true,
            "allOf": [
              {
                "$ref": "#/components/schemas/RelevanceAnalysis"
              }
            ],
            "description": "Output only. High-Precision Relevance Analysis verdict for the finding."
          },
          "displayName": {
            "type": "string",
            "description": "Required. A short descriptive title for the finding \u003c= 250 chars.\nEX: \"Actor 'baddy' offering $1000 for credentials of 'goodguy'\"."
          },
          "alert": {
            "description": "Optional. Name of the alert that this finding is bound to.",
            "type": "string"
          }
        },
        "description": "A ‘stateless’ and a point in time event that a check produced a result\nof interest.",
        "required": [
          "provider",
          "displayName",
          "detail"
        ],
        "type": "object"
      },
      "CustomerProfileSecurityConsiderations": {
        "description": "Security considerations for the customer profile.",
        "type": "object",
        "properties": {
          "considerations": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Optional. A series of considerations for the security of the organization,\nsuch as \"high risk of compromise\" or \"vulnerable to cyberbullying\"."
          },
          "note": {
            "description": "Optional. A note about the security considerations.",
            "type": "string"
          }
        }
      },
      "InsiderThreatFindingDetail": {
        "type": "object",
        "description": "A detail object for a InsiderThreat finding.",
        "required": [
          "matchScore",
          "severity"
        ],
        "properties": {
          "documentId": {
            "type": "string",
            "deprecated": true,
            "description": "Optional. Deprecated: Use `discovery_document` instead.\nThe unique identifier of the document that triggered the InsiderThreat\nfinding. This ID can be used to retrieve the content of the document for\nfurther analysis."
          },
          "matchScore": {
            "description": "Required. Reference to the match score of the InsiderThreat finding. This is a float\nvalue greater than 0 and less than or equal to 1 calculated by the matching\nengine based on the similarity of the document and the user provided\nconfigurations.",
            "type": "number",
            "format": "float"
          },
          "severity": {
            "description": "Required. The severity of the InsiderThreat finding. This indicates the potential\nimpact of the threat.",
            "type": "string",
            "enum": [
              "SEVERITY_UNSPECIFIED",
              "LOW",
              "MEDIUM",
              "HIGH",
              "CRITICAL"
            ],
            "x-google-enum-descriptions": [
              "Default value, should never be set.",
              "Low severity.",
              "Medium severity.",
              "High severity.",
              "Critical severity."
            ]
          },
          "discoveryDocument": {
            "description": "Optional. The discovery document associated with the Insider Threat finding.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DiscoveryDocument"
              }
            ]
          }
        }
      },
      "SearchFindingsResponse": {
        "type": "object",
        "description": "Response message for SearchFindings.",
        "properties": {
          "nextPageToken": {
            "type": "string",
            "description": "Page token."
          },
          "findings": {
            "items": {
              "$ref": "#/components/schemas/Finding"
            },
            "type": "array",
            "description": "List of findings."
          }
        }
      },
      "DomainMonitoringAlertDetail": {
        "type": "object",
        "properties": {
          "matchedDomain": {
            "description": "Optional. The matched domain.",
            "type": "string"
          },
          "infrastructure": {
            "allOf": [
              {
                "$ref": "#/components/schemas/Infrastructure"
              }
            ],
            "description": "Optional. The infrastructure of the domain or URL."
          },
          "gtiDetails": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringGtiDetails"
              }
            ],
            "description": "Optional. The GTI details of the domain or URL."
          },
          "domainDetails": {
            "description": "Details specific to a monitored domain.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringDomainDetails"
              }
            ]
          },
          "relationships": {
            "description": "Optional. The relationships of the domain or URL.",
            "allOf": [
              {
                "$ref": "#/components/schemas/Relationships"
              }
            ]
          },
          "protectedDomain": {
            "description": "The protected domain that triggered the alert.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringDomainDetails"
              }
            ]
          },
          "threatAttributionDetails": {
            "allOf": [
              {
                "$ref": "#/components/schemas/ThreatAttributionDetails"
              }
            ],
            "description": "Optional. The threat attribution details of the domain or URL."
          },
          "urlDetails": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringUrlDetails"
              }
            ],
            "description": "Details specific to a monitored URL."
          },
          "protectedBrand": {
            "type": "string",
            "description": "The protected brand name that triggered the alert."
          },
          "registrationDetails": {
            "description": "Optional. Extracted WHOIS and DNS registration details.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DnsRegistrationDetails"
              }
            ]
          },
          "dnsDetails": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringDnsDetails"
              }
            ],
            "description": "Optional. The DNS details of the domain or URL."
          },
          "whoisDetails": {
            "description": "Optional. The whois details of the domain or URL.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringWhoIsDetails"
              }
            ]
          }
        },
        "description": "A detailed object for a Domain or URL alert."
      },
      "ConfigurationDetail": {
        "properties": {
          "detailType": {
            "description": "Output only. Name of the detail type. Will be set by the server during creation to the\nname of the field that is set in the detail union.",
            "readOnly": true,
            "type": "string"
          },
          "customThreatScenario": {
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomThreatScenarioConfig"
              }
            ],
            "description": "Custom Threat Scenario detail config."
          },
          "technologyWatchlist": {
            "allOf": [
              {
                "$ref": "#/components/schemas/TechnologyWatchListConfig"
              }
            ],
            "description": "Technology Watchlist detail config."
          },
          "domainMonitoring": {
            "description": "Domain Monitoring detail config.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringConfig"
              }
            ]
          },
          "domainConfiguration": {
            "description": "Domain Configuration detail config.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainConfiguration"
              }
            ]
          },
          "customerProfile": {
            "description": "Customer Profile detail config.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileConfig"
              }
            ]
          }
        },
        "type": "object",
        "description": "Wrapper class that contains the union struct for all the various\nconfiguration detail specific classes."
      },
      "ConfidenceLevel": {
        "x-google-enum-descriptions": [
          "Default value. Confidence level is not specified.",
          "Low confidence in the verdict.",
          "Medium confidence in the verdict.",
          "High confidence in the verdict."
        ],
        "type": "string",
        "enum": [
          "CONFIDENCE_LEVEL_UNSPECIFIED",
          "CONFIDENCE_LEVEL_LOW",
          "CONFIDENCE_LEVEL_MEDIUM",
          "CONFIDENCE_LEVEL_HIGH"
        ]
      },
      "GenerateOrgProfileConfigurationOperation": {
        "description": "This resource represents a long-running operation where metadata and response fields are strongly typed.",
        "type": "object",
        "allOf": [
          {
            "$ref": "#/components/schemas/BaseOperation"
          },
          {
            "properties": {
              "metadata": {
                "$ref": "#/components/schemas/OperationMetadata"
              },
              "response": {
                "$ref": "#/components/schemas/Configuration"
              }
            },
            "type": "object"
          }
        ]
      },
      "MarkAlertAsNotActionableRequest": {
        "description": "Request message for MarkAlertAsNotActionable.",
        "type": "object"
      },
      "LegacyMetadata": {
        "description": "Legacy metadata associated with this scenario/monitor.",
        "type": "object",
        "properties": {
          "templateId": {
            "description": "Output only. ID of the template this monitor was created from.",
            "readOnly": true,
            "type": "string"
          },
          "staleTime": {
            "description": "Output only. Time the legacy monitor was considered stale.",
            "readOnly": true,
            "format": "date-time",
            "type": "string"
          },
          "disabledReason": {
            "readOnly": true,
            "description": "Output only. Reason why the monitor is disabled (if applicable).",
            "type": "string"
          },
          "emailNotificationEnabled": {
            "type": "boolean",
            "readOnly": true,
            "description": "Output only. Deprecated: Whether email notifications are enabled. This field will not\nbe used as email notifications are handled through the GTI Mail Hub.",
            "deprecated": true
          },
          "aggregationEnabled": {
            "readOnly": true,
            "type": "boolean",
            "description": "Output only. Whether aggregation is enabled for alerts from this monitor."
          },
          "updaterUserId": {
            "type": "string",
            "description": "Output only. User ID who last updated the monitor.",
            "readOnly": true
          },
          "aggregationSimilarity": {
            "description": "Output only. Similarity threshold for aggregation.",
            "type": "number",
            "readOnly": true,
            "format": "double"
          },
          "disabledCode": {
            "readOnly": true,
            "description": "Output only. Code indicating why the monitor is disabled (if applicable).",
            "type": "string"
          },
          "emailNotificationImmediate": {
            "deprecated": true,
            "readOnly": true,
            "description": "Output only. Deprecated: Whether email notifications are intermediate/immediate. This\nfield will not be used as email notifications are handled through the\nGTI Mail Hub.",
            "type": "boolean"
          },
          "version": {
            "description": "Output only. Version of the monitor configuration.",
            "type": "integer",
            "readOnly": true,
            "format": "int32"
          },
          "displayName": {
            "description": "Output only. Name of the legacy monitor.",
            "readOnly": true,
            "type": "string"
          },
          "description": {
            "description": "Output only. Description of the legacy monitor.",
            "readOnly": true,
            "type": "string"
          },
          "legacyMonitorId": {
            "readOnly": true,
            "description": "Output only. Unique identifier of the legacy monitor.",
            "type": "string"
          },
          "tenantId": {
            "readOnly": true,
            "type": "string",
            "description": "Output only. ID of the tenant owning the monitor."
          },
          "conditionVersion": {
            "type": "integer",
            "description": "Output only. Version of the condition schema.",
            "format": "int32",
            "readOnly": true
          },
          "creatorUserId": {
            "description": "Output only. User ID who created the monitor.",
            "type": "string",
            "readOnly": true
          }
        }
      },
      "SeverityLevel": {
        "type": "string",
        "enum": [
          "SEVERITY_LEVEL_UNSPECIFIED",
          "SEVERITY_LEVEL_LOW",
          "SEVERITY_LEVEL_MEDIUM",
          "SEVERITY_LEVEL_HIGH"
        ],
        "x-google-enum-descriptions": [
          "Default value, should never be set.",
          "Low Severity.",
          "Medium Severity.",
          "High Severity."
        ]
      },
      "CustomerProfileLocation": {
        "type": "object",
        "properties": {
          "address": {
            "description": "Required. The address of the location.",
            "type": "string"
          },
          "citationIds": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "description": "Optional. The citation ids for the location."
          },
          "facilityType": {
            "description": "Optional. The type of location.",
            "type": "string"
          },
          "brand": {
            "type": "string",
            "description": "Required. The brand of the location."
          }
        },
        "required": [
          "brand",
          "address"
        ],
        "description": "Location information for the customer profile."
      },
      "Audit": {
        "type": "object",
        "description": "Tracks basic CRUD facts.",
        "properties": {
          "updateTime": {
            "format": "date-time",
            "readOnly": true,
            "type": "string",
            "description": "Output only. Time of creation or last update."
          },
          "creator": {
            "readOnly": true,
            "description": "Output only. Agent that created or updated the record, could be a UserId or a JobId.",
            "type": "string"
          },
          "updater": {
            "readOnly": true,
            "description": "Output only. Agent that last updated the record, could be a UserId or a JobId.",
            "type": "string"
          },
          "createTime": {
            "format": "date-time",
            "type": "string",
            "description": "Output only. Time of creation.",
            "readOnly": true
          }
        }
      },
      "SeverityAnalysis": {
        "properties": {
          "severityLevel": {
            "allOf": [
              {
                "$ref": "#/components/schemas/SeverityLevel"
              }
            ],
            "description": "The level of severity."
          },
          "reasoning": {
            "description": "Human-readable explanation from the model, detailing why a particular\nresult is considered to have a certain severity.",
            "type": "string"
          },
          "confidence": {
            "description": "The level of confidence in the given verdict.",
            "allOf": [
              {
                "$ref": "#/components/schemas/ConfidenceLevel"
              }
            ]
          }
        },
        "type": "object",
        "description": "Structured severity analysis for a threat."
      },
      "PublicExploit": {
        "type": "object",
        "properties": {
          "exploitName": {
            "description": "Required. The name of the exploit. Ex: \"Magentounauth.php.txt\".",
            "type": "string"
          },
          "exploitGrade": {
            "x-google-enum-descriptions": [
              "Unspecified exploit grade.",
              "Unevaluated exploit grade.",
              "Proof-of-concept exploit grade.",
              "Non-weaponized exploit grade.",
              "Weaponized exploit grade.",
              "Scanner exploit grade.",
              "Fake exploit grade."
            ],
            "type": "string",
            "enum": [
              "EXPLOIT_GRADE_UNSPECIFIED",
              "UNEVALUATED",
              "PROOF_OF_CONCEPT",
              "NON_WEAPONIZED",
              "WEAPONIZED",
              "SCANNER",
              "FAKE"
            ],
            "description": "Optional. The grade of the exploit. Ex: \"non-weaponized\"."
          },
          "exploitReliability": {
            "description": "Optional. The reliability of the exploit. Ex: \"Unreviewed\".",
            "x-google-enum-descriptions": [
              "Unspecified exploit reliability.",
              "Confirmed exploit reliability.",
              "Uncorroborated exploit reliability.",
              "Unconfirmed exploit reliability."
            ],
            "type": "string",
            "enum": [
              "EXPLOIT_RELIABILITY_UNSPECIFIED",
              "UNREVIEWED",
              "REVIEWED",
              "TESTED"
            ]
          },
          "releaseTime": {
            "type": "string",
            "format": "date-time",
            "description": "Optional. The release time of the exploit."
          },
          "uri": {
            "type": "string",
            "description": "Optional. The URI of the exploit."
          },
          "sizeBytes": {
            "type": "string",
            "format": "int64",
            "description": "Optional. The size of the exploit."
          }
        },
        "description": "Contains details about a public exploit.",
        "required": [
          "exploitName"
        ]
      },
      "CustomerProfileBrand": {
        "properties": {
          "brand": {
            "description": "Required. The name of the brand.",
            "type": "string"
          },
          "citationIds": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Optional. The citation ids for the brand."
          },
          "id": {
            "type": "string",
            "description": "Optional. The unique identifier for the brand."
          }
        },
        "type": "object",
        "description": "Brand information for the customer profile.",
        "required": [
          "brand"
        ]
      },
      "ConfigurationRevision": {
        "properties": {
          "name": {
            "description": "Identifier. The name of the ConfigurationRevision\nFormat: projects//configurations//revisions/",
            "x-google-identifier": true,
            "type": "string"
          },
          "snapshot": {
            "description": "The snapshot of the configuration",
            "allOf": [
              {
                "$ref": "#/components/schemas/Configuration"
              }
            ]
          },
          "createTime": {
            "format": "date-time",
            "readOnly": true,
            "description": "Output only. The time the Revision was created",
            "type": "string"
          }
        },
        "type": "object",
        "description": "A ConfigurationRevision is a snapshot of a Configuration at a point in time.\nIt is immutable."
      },
      "DomainMonitoringDomainDetails": {
        "properties": {
          "domain": {
            "description": "Required. The domain name to match against.",
            "type": "string"
          }
        },
        "required": [
          "domain"
        ],
        "description": "Details specific to a monitored domain.",
        "type": "object"
      },
      "PriorityLevel": {
        "type": "string",
        "enum": [
          "PRIORITY_LEVEL_UNSPECIFIED",
          "PRIORITY_LEVEL_LOW",
          "PRIORITY_LEVEL_MEDIUM",
          "PRIORITY_LEVEL_HIGH",
          "PRIORITY_LEVEL_CRITICAL"
        ],
        "x-google-enum-descriptions": [
          "Default value, should never be set.",
          "Low Priority.",
          "Medium Priority.",
          "High Priority.",
          "Critical Priority."
        ]
      },
      "UpsertConfigurationResponse": {
        "type": "object",
        "properties": {
          "configuration": {
            "readOnly": true,
            "type": "string",
            "description": "Output only. Created configuration ID with server assigned id."
          }
        },
        "description": "Response message for UpsertConfiguration."
      },
      "DiscoveryDocument": {
        "properties": {
          "communicationContext": {
            "description": "Optional. Detailed communication context metadata for documents originating from\ndeep and dark web communication channels.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CommunicationContext"
              }
            ]
          },
          "documentId": {
            "readOnly": true,
            "type": "string",
            "description": "Output only. The identifier of the discovery document."
          },
          "documentType": {
            "type": "string",
            "readOnly": true,
            "description": "Output only. The classification/type of the document (e.g. `COMMUNICATION`,\n`DDW_COMMUNICATION`, `message`)."
          }
        },
        "description": "Replaces the raw string ID to hold associated metadata.",
        "type": "object"
      },
      "ListFindingsResponse": {
        "properties": {
          "nextPageToken": {
            "description": "Page token.",
            "type": "string"
          },
          "findings": {
            "items": {
              "$ref": "#/components/schemas/Finding"
            },
            "description": "List of findings.",
            "type": "array"
          }
        },
        "type": "object",
        "description": "Response message for ListFindings."
      },
      "VulnerabilityMatch": {
        "type": "object",
        "description": "Contains details about a vulnerability match.",
        "properties": {
          "publiclyAvailableExploit": {
            "readOnly": true,
            "type": "boolean",
            "description": "Output only. Whether a publicly available exploit exists."
          },
          "description": {
            "description": "Required. A description of the vulnerability.",
            "type": "string"
          },
          "publicExploits": {
            "description": "Optional. List of public exploits.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/PublicExploit"
            }
          },
          "cvss3Score": {
            "description": "Required. The CVSS score of the vulnerability. Evaluates to CVSS v3 when available\nwith a fallback to v2 and v4. Example: 6.4.",
            "format": "float",
            "type": "number"
          },
          "riskRating": {
            "description": "Required. The risk rating of the vulnerability.",
            "type": "string",
            "enum": [
              "RISK_RATING_UNSPECIFIED",
              "LOW",
              "MEDIUM",
              "HIGH",
              "CRITICAL",
              "UNRATED"
            ],
            "x-google-enum-descriptions": [
              "Unspecified risk rating. This is the default value when the risk rating\nis not set.",
              "Low risk rating.",
              "Medium risk rating.",
              "High risk rating.",
              "Critical risk rating.",
              "The vulnerability has been assessed, but a specific risk rating could\nnot be determined or assigned."
            ]
          },
          "matchedTechnologies": {
            "description": "Optional. The entries from the configured watchlist that triggered the match, exactly\nas written in `TechnologyWatchListConfig.technologies`. Ex:\n`apache http_server 2.4.54`.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "productFixes": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/ProductFix"
            },
            "description": "Optional. List of product fixes for the vulnerability."
          },
          "exploitationConsequences": {
            "description": "Optional. List of exploitation consequences for the vulnerability.",
            "type": "array",
            "items": {
              "type": "string",
              "enum": [
                "EXPLOITATION_CONSEQUENCE_UNSPECIFIED",
                "CODE_EXECUTION",
                "COMMAND_EXECUTION",
                "DATA_LOSS",
                "DATA_MANIPULATION",
                "DENIAL_OF_SERVICE",
                "INFORMATION_DISCLOSURE",
                "UNAUTHORIZED_ACCESS",
                "PRIVILEGE_ESCALATION",
                "SANDBOX_ESCAPE",
                "SECURITY_BYPASS",
                "CONTAINER_ESCAPE",
                "SPOOFING"
              ],
              "x-google-enum-descriptions": [
                "Unspecified exploitation consequence.",
                "Code execution consequence.",
                "Command execution consequence.",
                "Data loss consequence.",
                "Data manipulation consequence.",
                "Denial-of-Service consequence.",
                "Information disclosure consequence.",
                "Unauthorized access consequence.",
                "Privilege escalation consequence.",
                "Sandbox escape consequence.",
                "Security bypass consequence.",
                "Container escape consequence.",
                "Spoofing consequence."
              ]
            }
          },
          "priority": {
            "x-google-enum-descriptions": [
              "Unspecified priority.",
              "Priority level 0.",
              "Priority level 1.",
              "Priority level 2.",
              "Priority level 3.",
              "Priority level 4."
            ],
            "type": "string",
            "enum": [
              "PRIORITY_UNSPECIFIED",
              "P0",
              "P1",
              "P2",
              "P3",
              "P4"
            ],
            "description": "Optional. The priority level of the vulnerability data. Ex: \"P1\"."
          },
          "collectionId": {
            "description": "Required. The collection ID of the vulnerability.\nEx: \"vulnerability--cve-2025-9876\".",
            "type": "string"
          },
          "disclosureTime": {
            "description": "Optional. The disclosure time of the vulnerability.",
            "type": "string",
            "format": "date-time"
          },
          "cveId": {
            "type": "string",
            "description": "Required. The CVE ID of the vulnerability. Ex: \"CVE-2025-9876\".\nSee https://www.cve.org/ for more information."
          },
          "technologies": {
            "description": "Required. All technologies affected by the vulnerability, using the vendor and\nproduct names of its affected products, optionally followed by a version.\nEx: `Apache Struts 2.2.3`.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "associations": {
            "description": "Optional. Associated threat actors, malware, etc. This is embedded as a snapshot\nbecause the details of the association at the time of the vulnerability\nmatch are important for context and reporting.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Association"
            }
          },
          "exploitationState": {
            "allOf": [
              {
                "$ref": "#/components/schemas/ExploitationState"
              }
            ],
            "description": "Required. The exploitation state of the vulnerability."
          },
          "epssScore": {
            "type": "number",
            "description": "Optional. The EPSS score, representing the probability of exploitation. Example:\n0.87.",
            "format": "float"
          },
          "exploitationVectors": {
            "description": "Optional. List of exploitation vectors for the vulnerability.",
            "type": "array",
            "items": {
              "type": "string",
              "enum": [
                "EXPLOITATION_VECTOR_UNSPECIFIED",
                "ADMINISTRATIVE_INTERFACE",
                "BLUETOOTH_ACCESS",
                "BROWSER",
                "COMPROMISED_COMMUNICATION_CHANNEL",
                "EMAIL",
                "EXPOSED_WEB_APPLICATION",
                "LOCAL_NETWORK_ACCESS",
                "MALICIOUS_APPLICATION",
                "MALICIOUS_FILE",
                "MALICIOUS_SERVER",
                "OPEN_PORT",
                "PHYSICAL_ACCESS",
                "SHORT_RANGE_RADIO",
                "UNSPECIFIED_LOCAL_VECTOR",
                "UNSPECIFIED_REMOTE_VECTOR",
                "VPN_ACCESS",
                "WIFI_ACCESS"
              ],
              "x-google-enum-descriptions": [
                "Unspecified exploitation vector.",
                "Administrative interface vector.",
                "Bluetooth access vector.",
                "Browser vector.",
                "Compromised communication channel vector.",
                "Email vector.",
                "Exposed web application vector.",
                "Local network access vector.",
                "Malicious application vector.",
                "Malicious file vector.",
                "Malicious server vector.",
                "Open port vector.",
                "Physical access vector.",
                "Short range radio vector.",
                "Unspecified local vector.",
                "Unspecified remote vector.",
                "VPN access vector.",
                "WiFi access vector."
              ]
            }
          }
        },
        "required": [
          "cveId",
          "collectionId",
          "description",
          "technologies",
          "cvss3Score",
          "riskRating",
          "exploitationState"
        ]
      },
      "MarkAlertAsResolvedRequest": {
        "type": "object",
        "description": "Request message for MarkAlertAsResolved."
      },
      "CustomerProfileCitedString": {
        "properties": {
          "value": {
            "type": "string",
            "description": "Required. The value of the string."
          },
          "citationIds": {
            "description": "Optional. The citation ids for the string.",
            "type": "array",
            "items": {
              "type": "string"
            }
          }
        },
        "type": "object",
        "required": [
          "value"
        ],
        "description": "A string with citation ids."
      },
      "InsiderThreatAlertDetail": {
        "type": "object",
        "properties": {
          "discoveryDocuments": {
            "items": {
              "$ref": "#/components/schemas/DiscoveryDocument"
            },
            "readOnly": true,
            "type": "array",
            "description": "Output only. New structured metadata payload."
          },
          "discoveryDocumentIds": {
            "items": {
              "type": "string"
            },
            "description": "Optional. Deprecated: Use `discovery_documents` instead.\nArray of ids to accommodate multiple discovery documents.",
            "deprecated": true,
            "type": "array"
          },
          "severity": {
            "type": "string",
            "description": "Required. The severity of the Insider Threat alert.\nAllowed values are:\n* `LOW`\n* `MEDIUM`\n* `HIGH`\n* `CRITICAL`"
          }
        },
        "required": [
          "severity"
        ],
        "description": "Captures the specific details of InsiderThreat alert."
      },
      "TechnologyWatchListAlertThreshold": {
        "properties": {
          "riskRatingMinimum": {
            "type": "string",
            "enum": [
              "RISK_RATING_UNSPECIFIED",
              "LOW",
              "MEDIUM",
              "HIGH",
              "CRITICAL",
              "UNRATED"
            ],
            "description": "Optional. The minimum risk rating for the alert.",
            "x-google-enum-descriptions": [
              "Unspecified risk rating. This is the default value when the risk rating\nis not set.",
              "Low risk rating.",
              "Medium risk rating.",
              "High risk rating.",
              "Critical risk rating.",
              "The vulnerability has been assessed, but a specific risk rating could\nnot be determined or assigned."
            ]
          },
          "epssScoreMinimum": {
            "type": "number",
            "description": "Optional. The minimum epss score for the alert. Ex: 0.8. Valid range is [0.0, 1.0].",
            "format": "float"
          },
          "priorityMinimum": {
            "description": "Optional. The minimum priority for the alert.",
            "type": "string",
            "enum": [
              "PRIORITY_UNSPECIFIED",
              "P0",
              "P1",
              "P2",
              "P3",
              "P4"
            ],
            "x-google-enum-descriptions": [
              "Unspecified priority.",
              "Priority level 0.",
              "Priority level 1.",
              "Priority level 2.",
              "Priority level 3.",
              "Priority level 4."
            ]
          },
          "exploitationStates": {
            "description": "Optional. The exploitation states of the alert.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/ExploitationState"
            }
          },
          "cvssScoreMinimum": {
            "format": "float",
            "description": "Optional. The minimum CVSS score for the alert. Evaluates to CVSS v3 when available\nwith a fallback to v2 and v4. Ex: 7.0. Valid range is [0.0, 10.0].",
            "type": "number"
          }
        },
        "type": "object",
        "description": "TechnologyWatchListAlertThreshold contains the thresholds for alerting."
      },
      "RelevanceAnalysis": {
        "description": "Structured relevance analysis for a threat.",
        "properties": {
          "evidence": {
            "allOf": [
              {
                "$ref": "#/components/schemas/Evidence"
              }
            ],
            "description": "Evidence supporting the verdict, including matched and unmatched items."
          },
          "relevant": {
            "description": "Indicates whether the threat is considered relevant.",
            "type": "boolean"
          },
          "relevanceLevel": {
            "description": "The level of relevance.",
            "allOf": [
              {
                "$ref": "#/components/schemas/RelevanceLevel"
              }
            ]
          },
          "confidence": {
            "allOf": [
              {
                "$ref": "#/components/schemas/ConfidenceLevel"
              }
            ],
            "description": "The level of confidence in the given verdict."
          },
          "reasoning": {
            "description": "Human-readable explanation from the matcher, detailing why a particular\nresult is considered relevant or not relevant.",
            "type": "string"
          }
        },
        "type": "object"
      },
      "OperationMetadata": {
        "type": "object",
        "description": "Metadata for the long-running operation.",
        "properties": {
          "createTime": {
            "description": "The time the operation was created.",
            "format": "date-time",
            "type": "string"
          },
          "updateTime": {
            "description": "The time the operation was last updated.",
            "type": "string",
            "format": "date-time"
          }
        }
      },
      "CustomerProfileProduct": {
        "properties": {
          "product": {
            "description": "Required. The name of the product.",
            "type": "string"
          },
          "brand": {
            "description": "Required. The brand of the product.",
            "type": "string"
          },
          "citationIds": {
            "description": "Optional. The citation ids for the product.",
            "items": {
              "type": "string"
            },
            "type": "array"
          }
        },
        "required": [
          "product",
          "brand"
        ],
        "type": "object",
        "description": "Product information for the customer profile."
      },
      "DomainMonitoringGtiDetails": {
        "properties": {
          "verdict": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringGtiVerdict"
              }
            ],
            "description": "Output only. The verdict of the domain.",
            "readOnly": true
          },
          "gtiDomainUri": {
            "description": "Optional. The GTI link for the domain.",
            "type": "string"
          },
          "avDetections": {
            "allOf": [
              {
                "$ref": "#/components/schemas/AVDetections"
              }
            ],
            "description": "Optional. Detection counts across vendor feeds."
          },
          "domainPermutation": {
            "type": "string",
            "description": "Optional. The permutation technique used for the domain (e.g., dictionary,\nhomoglyph)."
          },
          "gtiScore": {
            "format": "int32",
            "description": "Optional. The GTI score of the domain.\nThe threat score is a number between 0 and 100.",
            "type": "integer"
          },
          "threatClassification": {
            "description": "Optional. The threat classification of the domain, obtained from the domain report\n(e.g. DomainMonitoring).",
            "type": "string"
          }
        },
        "description": "The GTI details of the domain.",
        "type": "object"
      },
      "CertificateDetails": {
        "properties": {
          "subjectAlternativeNames": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "description": "Optional. The SSL subject alternative names."
          },
          "issuer": {
            "description": "Optional. The SSL certificate issuer.",
            "type": "string"
          }
        },
        "description": "Details regarding the SSL certificate configuration.",
        "type": "object"
      },
      "FacetCount": {
        "description": "FacetCount represents a count of records with each facet value.",
        "type": "object",
        "properties": {
          "value": {
            "description": "Value of the facet stringified.\nTimestamps will be formatted using RFC3339.",
            "type": "string"
          },
          "count": {
            "description": "Count of records with the value.",
            "type": "integer",
            "format": "int32"
          }
        }
      },
      "Alert": {
        "description": "Stateful object representing a group of Findings. Key feature to an Alert\nis that it expresses the user's intent towards the findings of that group,\neven those that haven't occurred yet.",
        "type": "object",
        "properties": {
          "etag": {
            "description": "Optional. If included when updating an alert, this should be set to the current etag\nof the alert. If the etags do not match, the update will be rejected and\nan ABORTED error will be returned.",
            "type": "string"
          },
          "findings": {
            "description": "Output only. Findings that are covered by this alert.",
            "type": "array",
            "items": {
              "type": "string"
            },
            "readOnly": true
          },
          "configurations": {
            "description": "Output only. The resource names of the Configurations bound to this alert.\nFormat: projects/{project}/configurations/{configuration}",
            "items": {
              "type": "string"
            },
            "readOnly": true,
            "type": "array"
          },
          "tags": {
            "readOnly": true,
            "description": "Output only. System taxonomy tags associated with this alert.",
            "items": {
              "$ref": "#/components/schemas/AlertTag"
            },
            "type": "array"
          },
          "priorityAnalysis": {
            "description": "Output only. High-Precision Priority Analysis for the alert.",
            "allOf": [
              {
                "$ref": "#/components/schemas/PriorityAnalysis"
              }
            ],
            "readOnly": true
          },
          "state": {
            "x-google-enum-descriptions": [
              "Default value, should never be set.",
              "alert is new.",
              "alert was read by a human.",
              "alert has been triaged.",
              "alert has been escalated.",
              "alert has been resolved.",
              "alert is a duplicate of another alert.",
              "alert is a false positive and should be ignored.",
              "alert is not actionable.",
              "alert is benign.",
              "alert is tracked externally."
            ],
            "description": "Output only. State of the alert.",
            "readOnly": true,
            "type": "string",
            "enum": [
              "STATE_UNSPECIFIED",
              "NEW",
              "READ",
              "TRIAGED",
              "ESCALATED",
              "RESOLVED",
              "DUPLICATE",
              "FALSE_POSITIVE",
              "NOT_ACTIONABLE",
              "BENIGN",
              "TRACKED_EXTERNALLY"
            ]
          },
          "detail": {
            "readOnly": true,
            "allOf": [
              {
                "$ref": "#/components/schemas/AlertDetail"
              }
            ],
            "description": "Output only. Details object for the alert, not all alerts will have a details object."
          },
          "name": {
            "type": "string",
            "x-google-identifier": true,
            "description": "Identifier. Server generated name for the alert.\nformat is projects/{project}/alerts/{alert}"
          },
          "displayName": {
            "type": "string",
            "readOnly": true,
            "description": "Output only. A short title for the alert."
          },
          "duplicatedBy": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "readOnly": true,
            "description": "Output only. alert names of the alerts that are duplicates of this alert.\nFormat: projects/{project}/alerts/{alert}"
          },
          "duplicateOf": {
            "readOnly": true,
            "description": "Output only. alert name of the alert this alert is a duplicate of.\nFormat: projects/{project}/alerts/{alert}",
            "type": "string"
          },
          "findingCount": {
            "description": "Output only. The number of findings associated with this alert.",
            "type": "string",
            "readOnly": true,
            "format": "int64"
          },
          "audit": {
            "readOnly": true,
            "allOf": [
              {
                "$ref": "#/components/schemas/Audit"
              }
            ],
            "description": "Output only. Audit information for the alert."
          },
          "relevanceAnalysis": {
            "description": "Output only. High-Precision Relevance Analysis verdict for the alert.",
            "allOf": [
              {
                "$ref": "#/components/schemas/RelevanceAnalysis"
              }
            ],
            "readOnly": true
          },
          "severityAnalysis": {
            "allOf": [
              {
                "$ref": "#/components/schemas/SeverityAnalysis"
              }
            ],
            "description": "Output only. High-Precision Severity Analysis for the alert.",
            "readOnly": true
          },
          "externalId": {
            "readOnly": true,
            "type": "string",
            "description": "Output only. External ID for the alert. This is used internally to provide protection\nagainst out of order updates."
          },
          "aiSummary": {
            "description": "Optional. AI summary of the alert.",
            "type": "string"
          }
        }
      },
      "Status": {
        "description": "The `Status` type defines a logical error model that is suitable for\ndifferent programming environments, including REST APIs and RPC APIs. It is\nused by [gRPC](https://github.com/grpc). Each `Status` message contains\nthree pieces of data: error code, error message, and error details.\n\nYou can find out more about this error model and how to work with it in the\n[API Design Guide](https://cloud.google.com/apis/design/errors).",
        "type": "object",
        "properties": {
          "details": {
            "type": "array",
            "description": "A list of messages that carry the error details.  There is a common set of\nmessage types for APIs to use.",
            "items": {
              "type": "object",
              "additionalProperties": {
                "description": "Properties of the object. Contains field @type with type URL."
              }
            }
          },
          "message": {
            "description": "A developer-facing error message, which should be in English. Any\nuser-facing error message should be localized and sent in the\ngoogle.rpc.Status.details field, or localized by the client.",
            "type": "string"
          },
          "code": {
            "description": "The status code, which should be an enum value of google.rpc.Code.",
            "format": "int32",
            "type": "integer"
          }
        }
      },
      "Infrastructure": {
        "type": "object",
        "description": "Core infrastructure observations associated with the URL or Domain.",
        "properties": {
          "certificateDetails": {
            "description": "Optional. SSL certificate details.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CertificateDetails"
              }
            ]
          },
          "urlResponse": {
            "description": "Optional. The raw URL response string.",
            "type": "string"
          }
        }
      },
      "RelevanceLevel": {
        "type": "string",
        "enum": [
          "RELEVANCE_LEVEL_UNSPECIFIED",
          "RELEVANCE_LEVEL_LOW",
          "RELEVANCE_LEVEL_MEDIUM",
          "RELEVANCE_LEVEL_HIGH"
        ],
        "x-google-enum-descriptions": [
          "Default value, should never be set.",
          "Low Relevance.",
          "Medium Relevance.",
          "High Relevance."
        ]
      },
      "DnsRegistrationDetails": {
        "description": "Extracted WHOIS and DNS registration details of the domain.",
        "properties": {
          "privateRegistration": {
            "description": "Optional. Indicates whether private registration is enabled on the WHOIS record.",
            "type": "boolean"
          },
          "expireTime": {
            "format": "date-time",
            "type": "string",
            "description": "Optional. The specific timestamp when the current domain registration expires."
          },
          "registrar": {
            "description": "Optional. The registrar where the domain was registered (e.g., NameCheap).",
            "type": "string"
          },
          "registrationTime": {
            "type": "string",
            "format": "date-time",
            "description": "Optional. The specific timestamp when the domain registration was created."
          },
          "registrantCountry": {
            "description": "Optional. The country code of the registrant (e.g., US).\nUse ISO 3166-1 alpha-2 codes",
            "type": "string"
          }
        },
        "type": "object"
      },
      "DomainMonitoringFeatureConfig": {
        "properties": {
          "disabled": {
            "description": "Optional. Whether the Domain Monitoring feature is disabled for the domain.",
            "type": "boolean"
          }
        },
        "type": "object",
        "description": "Specific configuration for the Domain Monitoring feature."
      },
      "DomainMonitoringDomain": {
        "description": "A Domain Monitoring \"domain\"",
        "type": "object",
        "properties": {
          "domain": {
            "type": "string",
            "description": "The domain name to match against."
          }
        }
      },
      "Evidence": {
        "description": "Details the evidence used to determine the relevance verdict.",
        "properties": {
          "commonThemes": {
            "description": "A list of semantic themes or concepts found to be common, related, or\naligned between the sources, supporting the verdict.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "distinctThemes": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "A list of semantic themes or descriptions unique to one source or\nsemantically distant."
          }
        },
        "type": "object"
      },
      "TargetTechnologyAlertDetail": {
        "properties": {
          "vulnerabilityMatch": {
            "allOf": [
              {
                "$ref": "#/components/schemas/VulnerabilityMatch"
              }
            ],
            "description": "Optional. The vulnerability match details."
          }
        },
        "description": "Contains details for a technology watchlist alert.",
        "type": "object"
      },
      "ListConfigurationsResponse": {
        "properties": {
          "configurations": {
            "description": "List of configurations.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Configuration"
            }
          },
          "nextPageToken": {
            "description": "Page token.",
            "type": "string"
          }
        },
        "type": "object",
        "description": "Response message for ListConfigurations."
      },
      "DataLeakAlertDetail": {
        "type": "object",
        "description": "Captures the specific details of Data Leak alert.",
        "required": [
          "severity"
        ],
        "properties": {
          "discoveryDocumentIds": {
            "description": "Optional. Deprecated: Use `discovery_documents` instead.\nArray of ids to accommodate multiple discovery documents.",
            "type": "array",
            "deprecated": true,
            "items": {
              "type": "string"
            }
          },
          "severity": {
            "description": "Required. The severity of the Data Leak alert.\nAllowed values are:\n* `LOW`\n* `MEDIUM`\n* `HIGH`\n* `CRITICAL`",
            "type": "string"
          },
          "discoveryDocuments": {
            "readOnly": true,
            "items": {
              "$ref": "#/components/schemas/DiscoveryDocument"
            },
            "type": "array",
            "description": "Output only. New structured metadata payload."
          }
        }
      },
      "AVDetections": {
        "properties": {
          "totalVendorCount": {
            "format": "int32",
            "description": "Optional. Total number of vendors.",
            "type": "integer"
          },
          "detectedVendorCount": {
            "format": "int32",
            "description": "Optional. Number of vendors that detected the threat.",
            "type": "integer"
          }
        },
        "type": "object",
        "description": "Details about the detection vendors."
      },
      "CustomerProfileConfig": {
        "properties": {
          "industries": {
            "items": {
              "$ref": "#/components/schemas/CustomerProfileIndustry"
            },
            "type": "array",
            "description": "Optional. The industries the organization is involved in."
          },
          "org": {
            "type": "string",
            "description": "Required. The name of the organization."
          },
          "technologies": {
            "description": "Optional. Technologies associated with the organization.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/CustomerProfileTechnology"
            }
          },
          "executives": {
            "description": "Optional. Executives of the organization.",
            "items": {
              "$ref": "#/components/schemas/CustomerProfilePerson"
            },
            "type": "array"
          },
          "technologyPresence": {
            "description": "Optional. Technology presence of the organization.",
            "type": "string"
          },
          "contactInfo": {
            "description": "Optional. Contact information for the organization.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/CustomerProfileContactInfo"
            }
          },
          "locations": {
            "type": "array",
            "description": "Optional. Locations the organization is present or conducts business in.",
            "items": {
              "$ref": "#/components/schemas/CustomerProfileLocation"
            }
          },
          "products": {
            "description": "Optional. Product information for the organization.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/CustomerProfileProduct"
            }
          },
          "parentCompanies": {
            "items": {
              "$ref": "#/components/schemas/CustomerProfileCompany"
            },
            "description": "Optional. The parent companies of the organization.",
            "type": "array"
          },
          "citations": {
            "description": "Optional. Citations for the organization profile.",
            "items": {
              "$ref": "#/components/schemas/CustomerProfileCitation"
            },
            "type": "array"
          },
          "summary": {
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileSummary"
              }
            ],
            "description": "Optional. A summarized version of the customer profile."
          },
          "webPresences": {
            "description": "Optional. Web presence of the organization.",
            "items": {
              "$ref": "#/components/schemas/CustomerProfileWebPresence"
            },
            "type": "array"
          },
          "securityConsiderations": {
            "description": "Optional. Security considerations for the organization.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CustomerProfileSecurityConsiderations"
              }
            ]
          },
          "brands": {
            "description": "Optional. Brands associated with the organization.",
            "items": {
              "$ref": "#/components/schemas/CustomerProfileBrand"
            },
            "type": "array"
          },
          "orgSummary": {
            "type": "string",
            "description": "Optional. A summary of the organization."
          }
        },
        "required": [
          "org"
        ],
        "description": "CustomerProfileConfig is the configuration for the customer profile.",
        "type": "object"
      },
      "CustomerProfileContactInfo": {
        "type": "object",
        "description": "Contact information for the customer profile.",
        "properties": {
          "address": {
            "type": "string",
            "description": "The address of the contact."
          },
          "email": {
            "type": "string",
            "description": "The email address of the contact."
          },
          "phone": {
            "type": "string",
            "description": "The phone number of the contact."
          },
          "other": {
            "type": "string",
            "description": "The other contact information."
          },
          "citationIds": {
            "description": "Optional. The citation ids for the contact information.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "label": {
            "description": "Optional. The name of the contact.",
            "type": "string"
          }
        }
      },
      "MarkAlertAsReadRequest": {
        "type": "object",
        "description": "Request message for MarkAlertAsRead."
      },
      "FindingDetail": {
        "description": "Wrapper class that contains the union struct for all the various findings\ndetail specific classes.",
        "properties": {
          "detailType": {
            "readOnly": true,
            "description": "Output only. Name of the detail type. Will be set by the server during creation to the\nname of the field that is set in the detail union.",
            "type": "string"
          },
          "insiderThreat": {
            "allOf": [
              {
                "$ref": "#/components/schemas/InsiderThreatFindingDetail"
              }
            ],
            "description": "Insider Threat finding detail type."
          },
          "initialAccessBroker": {
            "description": "Initial Access Broker finding detail type.",
            "allOf": [
              {
                "$ref": "#/components/schemas/InitialAccessBrokerFindingDetail"
              }
            ]
          },
          "dataLeak": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DataLeakFindingDetail"
              }
            ],
            "description": "Data Leak finding detail type."
          },
          "targetTechnology": {
            "description": "Technology Watchlist finding detail type.",
            "allOf": [
              {
                "$ref": "#/components/schemas/TargetTechnologyFindingDetail"
              }
            ]
          },
          "domainMonitoring": {
            "description": "Domain Monitoring finding detail type.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DomainMonitoringFindingDetail"
              }
            ]
          }
        },
        "type": "object"
      },
      "DomainMonitoringUrlDetails": {
        "required": [
          "url"
        ],
        "description": "Details specific to a monitored URL.",
        "properties": {
          "url": {
            "type": "string",
            "description": "Required. The URL to match against."
          }
        },
        "type": "object"
      },
      "EnumerateAlertFacetsResponse": {
        "type": "object",
        "description": "Response message for EnumerateAlertFacets.",
        "properties": {
          "facets": {
            "description": "List of facets and the counts.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Facet"
            }
          }
        }
      },
      "CustomerProfileTechnology": {
        "type": "object",
        "required": [
          "technology"
        ],
        "description": "Technology information for the customer profile.",
        "properties": {
          "technology": {
            "description": "Required. The name of the technology.",
            "type": "string"
          },
          "citationIds": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Optional. The citation ids for the technology."
          }
        }
      },
      "Association": {
        "type": "object",
        "description": "Represents an association with a vulnerability.",
        "properties": {
          "type": {
            "description": "Required. The type of the association.",
            "allOf": [
              {
                "$ref": "#/components/schemas/ThreatIntelObjectType"
              }
            ]
          },
          "id": {
            "description": "Required. The ID of the association.",
            "type": "string"
          }
        },
        "required": [
          "id",
          "type"
        ]
      },
      "AlertDocumentTranslation": {
        "type": "object",
        "description": "The translation of an alert document.",
        "properties": {
          "translatedContent": {
            "readOnly": true,
            "type": "string",
            "description": "Output only. The translated content of the document."
          },
          "translatedTitle": {
            "readOnly": true,
            "description": "Output only. The translated title of the document.",
            "type": "string"
          }
        }
      },
      "CommunicationContext": {
        "properties": {
          "channelName": {
            "type": "string",
            "description": "Optional. Name of the communication channel."
          },
          "channelUrl": {
            "type": "string",
            "description": "Optional. URL of the communication channel."
          },
          "threadId": {
            "description": "Optional. Conversation thread identifier.",
            "type": "string"
          },
          "messageId": {
            "type": "string",
            "description": "Optional. Message or post identifier on the originating platform."
          },
          "serviceName": {
            "type": "string",
            "description": "Optional. Service from the collection event origin (e.g. forum or chat service\nname)."
          },
          "channelPath": {
            "description": "Optional. Channel path (e.g. forum path or sub-channel).",
            "type": "string"
          },
          "channelDescription": {
            "description": "Optional. Description of the communication channel.",
            "type": "string"
          }
        },
        "type": "object",
        "description": "Detailed communication context metadata for documents originating from\ndeep and dark web communication channels."
      },
      "GetPasswordResponse": {
        "description": "Response message for GetPassword.",
        "type": "object",
        "properties": {
          "password": {
            "description": "The decrypted cleartext password for the compromised credential.",
            "type": "string"
          }
        }
      },
      "ListConfigurationRevisionsResponse": {
        "type": "object",
        "description": "Response message for ListConfigurationRevisions.",
        "properties": {
          "nextPageToken": {
            "type": "string",
            "description": "A token, which can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages."
          },
          "revisions": {
            "items": {
              "$ref": "#/components/schemas/ConfigurationRevision"
            },
            "type": "array",
            "description": "The Configuration Revisions associated with the specified Configuration"
          }
        }
      },
      "MarkAlertAsBenignRequest": {
        "description": "Request message for MarkAlertAsBenign.",
        "type": "object"
      },
      "CustomerProfileCitation": {
        "properties": {
          "citationId": {
            "type": "string",
            "description": "Required. The citation id for the citation.  Should be unique within the profile."
          },
          "source": {
            "description": "Required. The source of the citation.",
            "type": "string"
          },
          "retrievalTime": {
            "format": "date-time",
            "description": "The time the citation was retrieved.",
            "type": "string"
          },
          "document": {
            "type": "string",
            "description": "Required. The name of the document the citation is from."
          },
          "uri": {
            "description": "Optional. The url of the citation.",
            "type": "string"
          }
        },
        "description": "Citation information for the customer profile.",
        "type": "object",
        "required": [
          "citationId",
          "source",
          "document"
        ]
      },
      "AlertDocument": {
        "properties": {
          "author": {
            "type": "string",
            "readOnly": true,
            "description": "Output only. The author of the document."
          },
          "ingestTime": {
            "type": "string",
            "description": "Output only. Time when GTI received the intel.",
            "format": "date-time",
            "readOnly": true
          },
          "name": {
            "description": "Identifier. Server generated name for the alert document.\nformat is projects/{project}/alerts/{alert}/documents/{document}",
            "type": "string",
            "x-google-identifier": true
          },
          "communicationContext": {
            "description": "Output only. Platform identifiers of the message, thread and channel.",
            "allOf": [
              {
                "$ref": "#/components/schemas/CommunicationContext"
              }
            ],
            "readOnly": true
          },
          "createTime": {
            "format": "date-time",
            "readOnly": true,
            "type": "string",
            "description": "Output only. The timestamp of the original external publication of the document."
          },
          "source": {
            "readOnly": true,
            "description": "Output only. Source of the intel item, e.g. DarkMarket.",
            "type": "string"
          },
          "sourceUri": {
            "description": "Output only. URI of the intel item from the source.",
            "readOnly": true,
            "type": "string"
          },
          "content": {
            "description": "Output only. The content of the document.",
            "type": "string",
            "readOnly": true
          },
          "translation": {
            "readOnly": true,
            "description": "Output only. The translation of the document, if available.",
            "allOf": [
              {
                "$ref": "#/components/schemas/AlertDocumentTranslation"
              }
            ]
          },
          "aiSummary": {
            "readOnly": true,
            "type": "string",
            "description": "Output only. AI summary of the document."
          },
          "sourceUpdateTime": {
            "format": "date-time",
            "type": "string",
            "readOnly": true,
            "description": "Output only. Time when the intel was last updated by the source."
          },
          "title": {
            "readOnly": true,
            "type": "string",
            "description": "Output only. The title of the document, if available."
          },
          "collectionTime": {
            "type": "string",
            "format": "date-time",
            "readOnly": true,
            "description": "Output only. Time when the origin source collected the intel."
          },
          "languageCode": {
            "type": "string",
            "readOnly": true,
            "description": "Output only. The language code of the document."
          }
        },
        "description": "A document that is associated with an alert.",
        "type": "object"
      },
      "CustomerProfilePerson": {
        "properties": {
          "citationIds": {
            "description": "Optional. The citation ids for the person.",
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "title": {
            "description": "Optional. The title of the person.",
            "type": "string"
          },
          "name": {
            "description": "Required. The name of the person.",
            "type": "string"
          }
        },
        "type": "object",
        "required": [
          "name"
        ],
        "description": "Person information for the customer profile."
      },
      "DataLeakFindingDetail": {
        "type": "object",
        "required": [
          "matchScore",
          "severity"
        ],
        "description": "A detail object for a Data Leak finding.",
        "properties": {
          "discoveryDocument": {
            "description": "Optional. The discovery document associated with the Data Leak finding.",
            "allOf": [
              {
                "$ref": "#/components/schemas/DiscoveryDocument"
              }
            ]
          },
          "severity": {
            "description": "Required. The severity of the Data Leak finding. This indicates the potential\nimpact of the threat.",
            "type": "string",
            "enum": [
              "SEVERITY_UNSPECIFIED",
              "LOW",
              "MEDIUM",
              "HIGH",
              "CRITICAL"
            ],
            "x-google-enum-descriptions": [
              "Default value, should never be set.",
              "Low severity.",
              "Medium severity.",
              "High severity.",
              "Critical severity."
            ]
          },
          "documentId": {
            "deprecated": true,
            "description": "Optional. Deprecated: Use `discovery_document` instead.\nThe unique identifier of the document that triggered the Data Leak finding.\nThis ID can be used to retrieve the content of the document for further\nanalysis.",
            "type": "string"
          },
          "matchScore": {
            "format": "float",
            "type": "number",
            "description": "Required. Reference to the match score of the Data Leak finding. This is a float\nvalue greater than 0 and less than or equal to 1 calculated by the matching\nengine based on the similarity of the document and the user provided\nconfigurations."
          }
        }
      },
      "ListAlertsResponse": {
        "properties": {
          "nextPageToken": {
            "type": "string",
            "description": "Page token."
          },
          "alerts": {
            "items": {
              "$ref": "#/components/schemas/Alert"
            },
            "type": "array",
            "description": "List of alerts."
          }
        },
        "description": "Response message for ListAlerts.",
        "type": "object"
      },
      "ThreatAttributionDetails": {
        "properties": {
          "malware": {
            "type": "array",
            "description": "Optional. The malware associated with the threat.",
            "items": {
              "type": "string"
            }
          },
          "collections": {
            "type": "array",
            "description": "Optional. The threat collections detected.",
            "items": {
              "type": "string"
            }
          },
          "actors": {
            "type": "array",
            "description": "Optional. The threat actors associated with the target.",
            "items": {
              "type": "string"
            }
          }
        },
        "description": "Threat attribution information (actor, campaign, etc.).",
        "type": "object"
      }
    }
  },
  "servers": [
    {
      "description": "Global Endpoint",
      "url": "https://threatintelligence.googleapis.com"
    },
    {
      "x-google-endpoint-location": "us-central1",
      "url": "https://threatintelligence.us-central1.rep.googleapis.com/",
      "description": "Regional Endpoint"
    }
  ]
}