Chapter 71. Common Object Reference

type

String

Resource type associated with the event. An event may refer to an underlying resource such as a particular image. In that case, the resource type will be filled here.

id

String

Resource ID associated with the event. If an event refers to an underlying resource, the resource ID identifies the underlying resource. The resource ID is not guaranteed to be set, depending on the context of the administration event.

name

String

Resource name associated with the event. If an event refers to an underlying resource, the resource name identifies the underlying resource. The resource name is not guaranteed to be set, depending on the context of the administration event.

image

StorageContainerImage

name

String

action

StorageEnforcementAction

UNSET_ENFORCEMENT, SCALE_TO_ZERO_ENFORCEMENT, UNSATISFIABLE_NODE_CONSTRAINT_ENFORCEMENT, KILL_POD_ENFORCEMENT, FAIL_BUILD_ENFORCEMENT, FAIL_KUBE_REQUEST_ENFORCEMENT, FAIL_DEPLOYMENT_CREATE_ENFORCEMENT, FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT,

message

String

severity

StorageSeverity

UNSET_SEVERITY, LOW_SEVERITY, MEDIUM_SEVERITY, HIGH_SEVERITY, CRITICAL_SEVERITY,

count

String

int64

id

String

name

String

clusterId

String

This field has to be duplicated in Alert for scope management and search.

clusterName

String

This field has to be duplicated in Alert for scope management and search.

message

String

processes

List of StorageProcessIndicator

whitelist

Boolean

addToBaseline

Boolean

message

String

keyValueAttrs

ViolationKeyValueAttrs

networkFlowInfo

ViolationNetworkFlowInfo

fileAccess

StorageFileAccess

type

AlertViolationType

GENERIC, K8S_EVENT, NETWORK_FLOW, NETWORK_POLICY, FILE_ACCESS,

time

Date

Indicates violation time. This field differs from top-level field 'time' which represents last time the alert occurred in case of multiple occurrences of the policy alert. As of 55.0, this field is set only for kubernetes event violations, but may not be limited to it in future.

date-time

key

String

A key within the identity token’s claim value to use.

valueExpression

String

A regular expression that will be evaluated against values of the identity token claim identified by the specified key. This regular expressions is in RE2 format, see more here: https://github.com/google/re2/wiki/Syntax.

role

String

The role which should be issued when the key and value match for a particular identity token.

attributeKey

String

attributeValue

String

name

String

type

String

uiEndpoint

String

enabled

Boolean

config

Map of string

Config holds auth provider specific configuration. Each configuration options are different based on the given auth provider type.

OIDC:

OpenShift Auth: supports no extra configuration options.

User PKI:

SAML:

IAP:

loginUrl

String

The login URL will be provided by the backend, and may not be specified in a request.

validated

Boolean

extraUiEndpoints

List of string

UI endpoints which to allow in addition to ui_endpoint. I.e., if a login request is coming from any of these, the auth request will use these for the callback URL, not ui_endpoint.

active

Boolean

requiredAttributes

List of AuthProviderRequiredAttribute

traits

StorageTraits

claimMappings

Map of string

Specifies claims from IdP token that will be copied to Rox token attributes. Each key in this map contains a path in IdP token we want to map. Path is separated by "." symbol.

For example, if IdP token payload looks like:

{
    "a": {
        "b" : "c",
        "d": true,
        "e": [ "val1", "val2", "val3" ],
        "f": [ true, false, false ],
        "g": 123.0,
        "h": [ 1, 2, 3]
    }
}

then "a.b" would be a valid key and "a.z" is not.

We support the following types of claims:

We do NOT support the following types of claims:

Each value in this map contains a Rox token attribute name we want to add claim to. If, for example, value is "groups", claim would be found in "external_user.Attributes.groups" in token.

Note: we only support this feature for OIDC auth provider.

lastUpdated

Date

Last updated indicates the last time the auth provider has been updated. In case there have been tokens issued by an auth provider before this timestamp, they will be considered invalid. Subsequently, all clients will have to re-issue their tokens (either by refreshing or by an additional login attempt).

date-time

name

String

enabled

Boolean

config

AuthServiceUpdateAuthMachineToMachineConfigBody

type

V1AuthMachineToMachineConfigType

GENERIC, GITHUB_ACTIONS, KUBE_SERVICE_ACCOUNT,

tokenExpirationDuration

String

Sets the expiration of the token returned from the ExchangeAuthMachineToMachineToken API call. Possible valid time units are: s, m, h. The maximum allowed expiration duration is 24h. As an example: 2h45m. For additional information on the validation of the duration, see: https://pkg.go.dev/time#ParseDuration.

mappings

List of AuthMachineToMachineConfigMapping

At least one mapping is required to resolve to a valid role for the access token to be successfully generated.

issuer

String

The issuer of the related OIDC provider issuing the ID tokens to exchange. Must be non-empty string containing URL when type is GENERIC. In case of GitHub actions, this must be empty or set to https://token.actions.githubusercontent.com. Issuer is a unique key, therefore there may be at most one GITHUB_ACTIONS config, and each GENERIC config must have a distinct issuer.

traits

V1Traits

scopeCheckerType

String

builtIn

TraceBuiltInAuthorizer

username

String

friendlyName

String

aggregatedPermissions

Map of StorageAccess

roles

List of UserRole

type

String

suggestedAttributes

List of string

baseImageTagPattern

String

id

String

error

String

URI

String

tags

List of string

userId

String

endpoint

String

storageKeyV1

String

secret

String

Used for single-valued authentication via long-lived tokens.

clientId

String

Used for client authentication in combination with client_secret.

clientSecret

String

Used for client authentication in combination with client_id.

cloudSource

CloudSourcesServiceUpdateCloudSourceBody

updateCredentials

Boolean

If true, cloud_source must include valid credentials. If false, the resource must already exist and credentials in cloud_source are ignored.

name

String

type

V1CloudSourceType

TYPE_UNSPECIFIED, TYPE_PALADIN_CLOUD, TYPE_OCM,

credentials

CloudSourceCredentials

skipTestIntegration

Boolean

paladinCloud

V1PaladinCloudConfig

ocm

V1OCMConfig

severity

StorageSeverity

UNSET_SEVERITY, LOW_SEVERITY, MEDIUM_SEVERITY, HIGH_SEVERITY, CRITICAL_SEVERITY,

events

List of V1AlertEvent

phase

String

result

String

errorMessage

String

lastTransitionTime

Date

date-time

active

Boolean

id

String

targetVersion

String

upgraderImage

String

initiatedAt

Date

date-time

progress

StorageUpgradeProgress

type

UpgradeProcessStatusUpgradeProcessType

UPGRADE, CERT_ROTATION,

name

String

type

StorageClusterType

GENERIC_CLUSTER, KUBERNETES_CLUSTER, OPENSHIFT_CLUSTER, OPENSHIFT4_CLUSTER,

labels

Map of string

mainImage

String

collectorImage

String

centralApiEndpoint

String

runtimeSupport

Boolean

collectionMethod

StorageCollectionMethod

UNSET_COLLECTION, NO_COLLECTION, KERNEL_MODULE, EBPF, CORE_BPF,

admissionController

Boolean

admissionControllerUpdates

Boolean

admissionControllerEvents

Boolean

status

StorageClusterStatus

dynamicConfig

StorageDynamicClusterConfig

tolerationsConfig

StorageTolerationsConfig

priority

String

int64

healthStatus

StorageClusterHealthStatus

slimCollector

Boolean

helmConfig

StorageCompleteClusterConfig

mostRecentSensorId

StorageSensorDeploymentIdentification

auditLogState

Map of StorageAuditLogFileState

For internal use only.

initBundleId

String

managedBy

StorageManagerType

MANAGER_TYPE_UNKNOWN, MANAGER_TYPE_MANUAL, MANAGER_TYPE_HELM_CHART, MANAGER_TYPE_KUBERNETES_OPERATOR,

sensorCapabilities

List of string

admissionControllerFailOnError

Boolean

name

String

description

String

resourceSelectors

List of StorageResourceSelector

embeddedCollectionIds

List of string

scope

StorageComplianceAggregationScope

UNKNOWN, STANDARD, CLUSTER, CATEGORY, CONTROL, NAMESPACE, NODE, DEPLOYMENT, CHECK,

id

String

aggregationKeys

List of ComplianceAggregationAggregationKey

unit

StorageComplianceAggregationScope

UNKNOWN, STANDARD, CLUSTER, CATEGORY, CONTROL, NAMESPACE, NODE, DEPLOYMENT, CHECK,

numPassing

Integer

int32

numFailing

Integer

int32

numSkipped

Integer

int32

id

String

name

String

id

String

name

String

type

String

namespace

String

namespaceId

String

clusterId

String

clusterName

String

id

String

name

String

clusterId

String

clusterName

String

state

StorageComplianceState

COMPLIANCE_STATE_UNKNOWN, COMPLIANCE_STATE_SKIP, COMPLIANCE_STATE_NOTE, COMPLIANCE_STATE_SUCCESS, COMPLIANCE_STATE_FAILURE, COMPLIANCE_STATE_ERROR,

message

String

messageId

Integer

int32

platform

String

disruption

String

controlResults

Map of StorageComplianceResultValue

scanName

String

scanConfig

V2BaseComplianceScanConfigurationSettings

clusters

List of string

hideScanResults

Boolean

simpleRules

SimpleAccessScopeRules

key

String

value

String

envVarSource

EnvironmentConfigEnvVarSource

UNSET, RAW, SECRET_KEY, CONFIG_MAP_KEY, FIELD, RESOURCE_FIELD, UNKNOWN,

name

String

publicKeyPemEnc

String

pos

String

int64

path

String

The full path of the file.

bytesSize

String

The size of the file, in bytes. 0 if unknown.

int64

path

String

clusterId

String

name

String

type

String

alerts

List of StorageAlert

image

StorageContainerImage

name

String

values

List of string

port

Long

int64

l4protocol

StorageL4Protocol

L4_PROTOCOL_UNKNOWN, L4_PROTOCOL_TCP, L4_PROTOCOL_UDP, L4_PROTOCOL_ICMP, L4_PROTOCOL_RAW, L4_PROTOCOL_SCTP, L4_PROTOCOL_ANY,

deployment

String

violations

List of string

noPersistence

Boolean

Specifies whether to persist process indicators independently from other configuratons. If true, the filters above are ignored, and no process indicators are persisted. If false (the protobuf default for booleans), process indicators are persisted according to namespace_filter and exclude_openshift_ns.

excludeNamespaceFilter

String

A regex specifying to not persist process indicators from specified namespaces. E.g. namespace_filter: "test-.*" will instruct Central to not persist any process indicator coming from the "test-filtering" namespace.

excludeOpenshiftNs

Boolean

A short-cut to not persist process indicators from openshift namespaces. Equivalent to namespace_filter: "openshift-.*".

username

String

password

String

expiresAt

Date

date-time

id

String

name

String

state

StorageEffectiveAccessScopeState

UNKNOWN, INCLUDED, EXCLUDED, PARTIAL,

labels

Map of string

namespaces

List of StorageEffectiveAccessScopeNamespace

path

String

dependencies

List of string

name

String

scope

StorageScope

name

String

name

String

type

String

schedule

StorageSchedule

backupsToKeep

Integer

int32

s3

StorageS3Config

gcs

StorageGCSConfig

s3compatible

StorageS3Compatible

includeCertificates

Boolean

externalBackup

NextAvailableTag10

updatePassword

Boolean

When false, use the stored credentials of an existing external backup configuration given its ID.

uid

Long

int64

gid

Long

int64

mode

Long

int64

username

String

group

String

cluster

String

severities

List of ClusterAlertsAlertEvents

group

String

counts

List of AlertGroupAlertCounts

id

String

name

String

type

String

loginUrl

String

enableAutoUpgrade

Boolean

autoUpgradeFeature

GetSensorUpgradeConfigResponseSensorAutoUpgradeFeatureStatus

NOT_SUPPORTED, SUPPORTED,

code

Integer

int32

message

String

details

List of ProtobufAny

code

Integer

int32

message

String

labels

List of string

A list of labels to aggregate on. The complete list of labels for the given metric group can be found in the documentation, or in the API error message, returned when an invalid label is attempted to be added.

includeFilters

Map of string

A map of label name to a filter regular expression for this label value. See the RE2 syntax reference: https://github.com/google/re2/wiki/Syntax. If include_filters are specified, a metric record is only counted if all label values match the according label expression. Patterns are full-match only (automatically wrapped with ^ and $).

excludeFilters

Map of string

A map of label name to a filter regular expression for this label value. See the RE2 syntax reference: https://github.com/google/re2/wiki/Syntax. If exclude_filters are specified, a metric record is dropped if any label value matches the according label expression. Patterns are full-match only (automatically wrapped with ^ and $). Exclude filters are applied after include filters.

name

String

type

String

categories

List of StorageImageIntegrationCategory

clairify

StorageClairifyConfig

scannerV4

StorageScannerV4Config

docker

StorageDockerConfig

quay

StorageQuayConfig

ecr

StorageECRConfig

google

StorageGoogleConfig

clair

StorageClairConfig

clairV4

StorageClairV4Config

ibm

StorageIBMRegistryConfig

azure

StorageAzureConfig

autogenerated

Boolean

clusterId

String

skipTestIntegration

Boolean

source

StorageImageIntegrationSource

config

NextTag25

updatePassword

Boolean

When false, use the stored credentials of an existing image integration given its ID.

name

String

username

String

cluster

String

Cluster to delegate scan to, may be the cluster’s name or ID.

namespace

String

Namespace on the secured cluster from which to read context information when delegating image scans, specifically pull secrets to access the image registry.

imageName

X

String

Image name and reference. (e.g. nginx:latest or nginx@sha256:…​)

force

Boolean

Bypass Central’s cache for the image and force a new pull from the Scanner

digest

String

Image digest if not already part of image name

name

String

id

String

id

String

error

String

impactedClusters

List of InitBundleMetaImpactedCluster

severity

StorageSeverity

UNSET_SEVERITY, LOW_SEVERITY, MEDIUM_SEVERITY, HIGH_SEVERITY, CRITICAL_SEVERITY,

priorityName

String

key

String

value

String

key

String

op

StorageLabelSelectorOperator

UNKNOWN, IN, NOT_IN, EXISTS, NOT_EXISTS,

values

List of string

clusterName

String

namespace

String

clusterId

String

namespaceId

String

resourceType

StorageListAlertResourceType

DEPLOYMENT, SECRETS, CONFIGMAPS, CLUSTER_ROLES, CLUSTER_ROLE_BINDINGS, NETWORK_POLICIES, SECURITY_CONTEXT_CONSTRAINTS, EGRESS_FIREWALLS, NODE,

name

String

SORTName

String

name

String

deployment

StorageListDeployment

baselineStatuses

List of StorageContainerNameAndBaselineStatus

clientCert

String

PEM encoded ASN.1 DER format.

privateKey

String

PEM encoded PKCS #8, ASN.1 DER format.

streamName

String

dataCollectionRuleId

String

enabled

Boolean

peers

List of V1NetworkBaselineStatusPeer

peers

List of V1NetworkBaselinePeerStatus

name

String

namespace

String

cluster

String

listenPorts

List of DeploymentListenPort

name

String

cidr

String

default

Boolean

default indicates whether the external source is user-generated or system-generated.

discovered

Boolean

discovered indicates whether the external source is harvested from monitored traffic.

name

String

entityType

StorageNetworkEntityInfoType

UNKNOWN_TYPE, DEPLOYMENT, INTERNET, LISTEN_ENDPOINT, EXTERNAL_SOURCE, INTERNAL_ENTITIES,

deploymentNamespace

String

deploymentType

String

port

Integer

int32

entity

NetworkEntityInfoExternalSource

name

String

modification

StorageNetworkPolicyModification

deleteExisting

GenerateNetworkPoliciesRequestDeleteExistingPoliciesMode

UNKNOWN, NONE, GENERATED_ONLY, ALL,

includePorts

Boolean

name

String

type

String

schedule

StorageSchedule

backupsToKeep

Integer

int32

s3

StorageS3Config

gcs

StorageGCSConfig

s3compatible

StorageS3Compatible

includeCertificates

Boolean

name

String

type

String

uiEndpoint

String

labelKey

String

labelDefault

String

jira

StorageJira

email

StorageEmail

cscc

StorageCSCC

splunk

StorageSplunk

pagerduty

StoragePagerDuty

generic

StorageGeneric

sumologic

StorageSumoLogic

awsSecurityHub

StorageAWSSecurityHub

syslog

StorageSyslog

microsoftSentinel

StorageMicrosoftSentinel

notifierSecret

String

traits

StorageTraits

name

String

type

String

categories

List of StorageImageIntegrationCategory

clairify

StorageClairifyConfig