REST Resource: organizations.locations.securityProfiles

Resource: SecurityProfile

SecurityProfile is a resource that defines the behavior for one of many ProfileTypes.

JSON representation 
{
  "name": string,
  "description": string,
  "createTime": string,
  "updateTime": string,
  "etag": string,
  "labels": {
    string: string,
    ...
  },
  "type": enum (ProfileType),

  // Union field profile can be only one of the following:
  "threatPreventionProfile": {
    object (ThreatPreventionProfile)
  },
  "customMirroringProfile": {
    object (CustomMirroringProfile)
  },
  "customInterceptProfile": {
    object (CustomInterceptProfile)
  },
  "urlFilteringProfile": {
    object (UrlFilteringProfile)
  },
  "wildfireAnalysisProfile": {
    object (WildfireAnalysisProfile)
  }
  // End of list of possible types for union field profile.
}
Fields
name

string

Immutable. Identifier. Name of the SecurityProfile resource. It matches pattern projects|organizations/*/locations/{location}/securityProfiles/{securityProfile}.
description

string

Optional. An optional description of the profile. Max length 512 characters.
createTime

string (Timestamp format)

Output only. Resource creation timestamp.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime

string (Timestamp format)

Output only. Last resource update timestamp.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
etag

string

Output only. This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.
labels

map (key: string, value: string)

Optional. Labels as key value pairs.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
type

enum (ProfileType)

Immutable. The single ProfileType that the SecurityProfile resource configures.
Union field profile. The behavior for the ProfileType that the SecurityProfile resource is meant to configure. This field must correspond to the ProfileType of the SecurityProfile. profile can be only one of the following:
threatPreventionProfile

object (ThreatPreventionProfile)

The threat prevention configuration for the SecurityProfile.
customMirroringProfile

object (CustomMirroringProfile)

The custom Packet Mirroring v2 configuration for the SecurityProfile.
customInterceptProfile

object (CustomInterceptProfile)

The custom TPPI configuration for the SecurityProfile.
urlFilteringProfile

object (UrlFilteringProfile)

The URL filtering configuration for the SecurityProfile.
wildfireAnalysisProfile

object (WildfireAnalysisProfile)

The WildFire Analysis configurations for SecurityProfile.

ThreatPreventionProfile

ThreatPreventionProfile defines an action for specific threat signatures or severity levels.

JSON representation 
{
  "severityOverrides": [
    {
      object (SeverityOverride)
    }
  ],
  "threatOverrides": [
    {
      object (ThreatOverride)
    }
  ],
  "antivirusOverrides": [
    {
      object (AntivirusOverride)
    }
  ]
}
Fields
severityOverrides[]

object (SeverityOverride)

Optional. Configuration for overriding threats actions by severity match.
threatOverrides[]

object (ThreatOverride)

Optional. Configuration for overriding threats actions by threatId match. If a threat is matched both by configuration provided in severityOverrides and threatOverrides, the threatOverrides action is applied.
antivirusOverrides[]

object (AntivirusOverride)

Optional. Configuration for overriding antivirus actions per protocol.

SeverityOverride

Defines what action to take for a specific severity match.

JSON representation 
{
  "severity": enum (Severity),
  "action": enum (ThreatAction)
}
Fields
severity

enum (Severity)

Required. Severity level to match.
action

enum (ThreatAction)

Required. Threat action override.

Severity

Severity level.

Enums
SEVERITY_UNSPECIFIED Severity level not specified.
INFORMATIONAL Suspicious events that do not pose an immediate threat, but that are reported to call attention to deeper problems that could possibly exist.
LOW Warning-level threats that have very little impact on an organization's infrastructure. They usually require local or physical system access and may often result in victim privacy issues and information leakage.
MEDIUM Minor threats in which impact is minimized, that do not compromise the target or exploits that require an attacker to reside on the same local network as the victim, affect only non-standard configurations or obscure applications, or provide very limited access.
HIGH Threats that have the ability to become critical but have mitigating factors; for example, they may be difficult to exploit, do not result in elevated privileges, or do not have a large victim pool.
CRITICAL Serious threats, such as those that affect default installations of widely deployed software, result in root compromise of servers, and the exploit code is widely available to attackers. The attacker usually does not need any special authentication credentials or knowledge about the individual victims and the target does not need to be manipulated into performing any special functions.

ThreatAction

Threat action override.

Enums
THREAT_ACTION_UNSPECIFIED Threat action not specified.
DEFAULT_ACTION The default action (as specified by the vendor) is taken.
ALLOW The packet matching this rule will be allowed to transmit.
ALERT The packet matching this rule will be allowed to transmit, but a threat_log entry will be sent to the consumer project.
DENY The packet matching this rule will be dropped, and a threat_log entry will be sent to the consumer project.

ThreatOverride

Defines what action to take for a specific threatId match.

JSON representation 
{
  "threatId": string,
  "type": enum (ThreatType),
  "action": enum (ThreatAction)
}
Fields
threatId

string

Required. Vendor-specific ID of a threat to override.
type

enum (ThreatType)

Output only. Type of the threat (read only).
action

enum (ThreatAction)

Required. Threat action override. For some threat types, only a subset of actions applies.

ThreatType

Type of threat.

Enums
THREAT_TYPE_UNSPECIFIED Type of threat not specified.
UNKNOWN Type of threat is not derivable from threat ID. An override will be created for all types. Firewall will ignore overridden signature ID's that don't exist in the specific type.
VULNERABILITY Threats related to system flaws that an attacker might otherwise attempt to exploit.
ANTIVIRUS Threats related to viruses and malware found in executables and file types.
SPYWARE Threats related to command-and-control (C2) activity, where spyware on an infected client is collecting data without the user's consent and/or communicating with a remote attacker.
DNS Threats related to DNS.

AntivirusOverride

Defines what action to take for antivirus threats per protocol.

JSON representation 
{
  "protocol": enum (Protocol),
  "action": enum (ThreatAction)
}
Fields
protocol

enum (Protocol)

Required. Protocol to match.
action

enum (ThreatAction)

Required. Threat action override. For some threat types, only a subset of actions applies.

Protocol

Antivirus protocol.

Enums
PROTOCOL_UNSPECIFIED Protocol not specified.
SMTP SMTP protocol
SMB SMB protocol
POP3 POP3 protocol
IMAP IMAP protocol
HTTP2 HTTP2 protocol
HTTP HTTP protocol
FTP FTP protocol

CustomMirroringProfile

CustomMirroringProfile defines out-of-band integration behavior (mirroring). It is used by mirroring rules with a MIRROR action.

JSON representation 
{
  "mirroringEndpointGroup": string,
  "mirroringDeploymentGroups": [
    string
  ],
  "mirroringEndpointGroupType": enum (MirroringEndpointGroupType)
}
Fields
mirroringEndpointGroup

string

Required. Immutable. The target MirroringEndpointGroup. When a mirroring rule with this security profile attached matches a packet, a replica will be mirrored to the location-local target in this group.
mirroringDeploymentGroups[]

string

Optional. The target downstream MirroringDeploymentGroups. This field is used for Packet Broker mirroring endpoint groups to specify the deployment groups that the packet should be mirrored to by the broker.
mirroringEndpointGroupType

enum (MirroringEndpointGroupType)

Output only.

MirroringEndpointGroupType

The type of the mirroring endpoint group this Profile is attached to.

Enums
MIRRORING_ENDPOINT_GROUP_TYPE_UNSPECIFIED Default value. This value is unused.
DIRECT The endpoint group is a direct endpoint group.
BROKER The endpoint group is a broker endpoint group.

CustomInterceptProfile

CustomInterceptProfile defines in-band integration behavior (intercept). It is used by firewall rules with an APPLY_SECURITY_PROFILE_GROUP action.

JSON representation 
{
  "interceptEndpointGroup": string
}
Fields
interceptEndpointGroup

string

Required. The target InterceptEndpointGroup. When a firewall rule with this security profile attached matches a packet, the packet will be intercepted to the location-local target in this group.

UrlFilteringProfile

UrlFilteringProfile defines filters based on URL.

JSON representation 
{
  "urlFilters": [
    {
      object (UrlFilter)
    }
  ]
}
Fields
urlFilters[]

object (UrlFilter)

Optional. The list of filtering configs in which each config defines an action to take for some URL match.

UrlFilter

A URL filter defines an action to take for some URL match.

JSON representation 
{
  "filteringAction": enum (UrlFilteringAction),
  "urls": [
    string
  ],
  "priority": integer
}
Fields
filteringAction

enum (UrlFilteringAction)

Required. The action taken when this filter is applied.
urls[]

string

Required. The list of strings that a URL must match with for this filter to be applied.
priority

integer

Required. The priority of this filter within the URL Filtering Profile. Lower integers indicate higher priorities. The priority of a filter must be unique within a URL Filtering Profile.

UrlFilteringAction

Action to be taken when a URL matches a filter.

Enums
URL_FILTERING_ACTION_UNSPECIFIED Filtering action not specified.
ALLOW The connection matching this filter will be allowed to transmit.
DENY The connection matching this filter will be dropped.

WildfireAnalysisProfile

WildfireAnalysisProfile defines Palo Alto Networks WildFire behavior.

JSON representation 
{
  "wildfireSubmissionRules": [
    {
      object (WildfireSubmissionRule)
    }
  ],
  "wildfireInlineCloudAnalysisRules": [
    {
      object (WildfireInlineCloudAnalysisRule)
    }
  ],
  "wildfireOverrides": [
    {
      object (WildfireOverride)
    }
  ],
  "wildfireInlineMlOverrides": [
    {
      object (WildfireInlineMlOverride)
    }
  ],
  "wildfireRealtimeLookup": boolean,
  "wildfireInlineMlSettings": [
    {
      object (WildfireInlineMlSettings)
    }
  ],
  "wildfireThreatOverrides": [
    {
      object (WildfireThreatOverride)
    }
  ],
  "wildfireInlineMlSetting": {
    object (WildfireInlineMlSettings)
  }
}
Fields
wildfireSubmissionRules[]

object (WildfireSubmissionRule)

Optional. Configurations for WildFire file submissions.
wildfireInlineCloudAnalysisRules[]

object (WildfireInlineCloudAnalysisRule)

Optional. Configuration for WildFire inline cloud analysis.
wildfireOverrides[]

object (WildfireOverride)

Optional. Configuration for overriding WildFire actions per protocol.
wildfireInlineMlOverrides[]

object (WildfireInlineMlOverride)

Optional. Configuration for overriding inline ML WildFire actions per protocol.
wildfireRealtimeLookup

boolean

Optional. Whether to hold the transfer of a file while the WildFire real-time signature cloud performs a signature lookup. Default value is false.
wildfireInlineMlSettings[]
(deprecated)

object (WildfireInlineMlSettings)

Optional. Settings for WildFire Inline ML analysis.
wildfireThreatOverrides[]

object (WildfireThreatOverride)

Optional. Configuration for overriding WildFire threats action by threatId match.
wildfireInlineMlSetting

object (WildfireInlineMlSettings)

Optional. Settings for WildFire Inline ML analysis.

WildfireSubmissionRule

Defines the file types to be submitted for WildFire analysis and the direction of the traffic.

JSON representation 
{
  "fileSelectionMode": enum (FileSelectionMode),
  "direction": enum (Direction),

  // Union field file_selection can be only one of the following:
  "customFileTypes": {
    object (CustomFileTypes)
  }
  // End of list of possible types for union field file_selection.
}
Fields
fileSelectionMode

enum (FileSelectionMode)

Required. File selection mode for WildFire analysis.
direction

enum (Direction)

Required. Direction for the files to be analyzed by WildFire.
Union field file_selection. The behavior for the FileSelectionMode that the WildfireInlineCloudAnalysisRule configuration is meant to configure. This field must correspond to the FileSelectionMode of the WildfireSubmissionRule (checked by backend logic). If the FileSelectionMode is ALL_FILE_TYPES, then skip this field. file_selection can be only one of the following:
customFileTypes

object (CustomFileTypes)

Submit a custom list of file types for WildFire analysis.

CustomFileTypes

The options to submit a custom list of file types for scan.

JSON representation 
{
  "fileTypes": [
    enum (FileType)
  ]
}
Fields
fileTypes[]

enum (FileType)

Required. File types to be submitted for WildFire analysis.

FileType

File types supported by WildFire analysis.

Enums
FILE_TYPE_UNSPECIFIED File type not specified.
APK Android Application Package (APK) files.
ARCHIVE Roshal Archive (RAR) and 7-Zip (7z) archive files.
FLASH Adobe Flash applets and Flash content embedded in web pages.
JAR Java applets (JAR/class files types).
LINUX Executable and Linkable Format (ELF) files.
MS_OFFICE Files used by Microsoft Office.
PDF Portable Document Format (PDF) files.
PE Portable Executable (PE) files.
SCRIPT Various script files. Jscript (JS), VBScript (VBS), PowerShell Scripts (PS1), Batch (BAT), HTML Application (HTA).

FileSelectionMode

FileSelectionMode defines the options to submit a list of file types for WildFire analysis. Currently support all the file types or a custom list of file types. More selection modes will be added in the future.

Enums
FILE_SELECTION_MODE_UNSPECIFIED File selection mode not specified.
ALL_FILE_TYPES Submit all the file types for scan.
CUSTOM_FILE_TYPES Submit a custom list of file types for scan.

Direction

The direction of WildFire traffic.

Enums
DIRECTION_UNSPECIFIED Direction not specified.
UPLOAD Upload direction.
DOWNLOAD Download direction.
BOTH Both upload and download directions.

WildfireInlineCloudAnalysisRule

The list of file type configurations to be scanned by WildFire Inline Cloud Analysis.

JSON representation 
{
  "fileSelectionMode": enum (FileSelectionMode),
  "direction": enum (Direction),
  "action": enum (WildfireInlineCloudAnalysisAction),

  // Union field file_selection can be only one of the following:
  "customFileTypes": {
    object (CustomFileTypes)
  }
  // End of list of possible types for union field file_selection.
}
Fields
fileSelectionMode

enum (FileSelectionMode)

Required. File selection mode for WildFire inline cloud analysis.
direction

enum (Direction)

Required. Direction for the file to be analyzed by WildFire Inline Cloud Analysis.
action

enum (WildfireInlineCloudAnalysisAction)

Required. Action to take when a threat is detected using WildFire Inline Cloud Analysis. The default Value is DENY.
Union field file_selection. The behavior for the FileSelectionMode that the WildfireInlineCloudAnalysisRule configuration is meant to configure. This field must correspond to the FileSelectionMode of the WildfireInlineCloudAnalysisRule. If the FileSelectionMode is ALL_FILE_TYPES, then skip this field. file_selection can be only one of the following:
customFileTypes

object (CustomFileTypes)

Submit a custom list of file types for WildFire analysis.

CustomFileTypes

The options to submit a custom list of file types for scan.

JSON representation 
{
  "fileTypes": [
    enum (FileType)
  ]
}
Fields
fileTypes[]

enum (FileType)

Required. File types to be submitted for WildFire inline cloud analysis.

FileType

File types supported by WildFire analysis.

Enums
FILE_TYPE_UNSPECIFIED File type not specified.
PE Portable Executable (PE) files.

FileSelectionMode

FileSelectionMode defines the options to submit a list of file types for WildFire inline cloud analysis. Currently support all the file types or a custom list of file types. The default value is no file types sent for scan. More selection modes will be added in the future.

Enums
FILE_SELECTION_MODE_UNSPECIFIED File selection mode not specified.
ALL_FILE_TYPES Submit all the file types for scan.
CUSTOM_FILE_TYPES Submit a custom list of file types for scan.

WildfireInlineCloudAnalysisAction

Available action to take when a threat is detected using WildFire Inline Cloud Analysis.

Enums
WILDFIRE_INLINE_CLOUD_ANALYSIS_ACTION_UNSPECIFIED WildFire Inline Cloud Analysis action not specified.
ALLOW The files caught by WildFire Inline Cloud Analysis will be allowed to transmit.
DENY The files caught by WildFire Inline Cloud Analysis will be denied to transmit.
ALERT The files caught by WildFire Inline Cloud Analysis will be allowed to transmit, but a wildfire_submission_log entry will be sent to the consumer project.

WildfireOverride

Defines what action to take for WildFire threats per protocol.

JSON representation 
{
  "protocol": enum (WildfireProtocol),
  "action": enum (WildfireThreatAction)
}
Fields
protocol

enum (WildfireProtocol)

Required. Protocol to match.
action

enum (WildfireThreatAction)

Required. Threat action override. For some threat types, only a subset of actions applies.

WildfireProtocol

WildFire protocol.

Enums
WILDFIRE_PROTOCOL_UNSPECIFIED Protocol not specified.
WILDFIRE_SMTP SMTP protocol
WILDFIRE_SMB SMB protocol
WILDFIRE_POP3 POP3 protocol
WILDFIRE_IMAP IMAP protocol
WILDFIRE_HTTP2 HTTP2 protocol
WILDFIRE_HTTP HTTP protocol
WILDFIRE_FTP FTP protocol

WildfireThreatAction

Threat action override for WildFire.

Enums
WILDFIRE_THREAT_ACTION_UNSPECIFIED Threat action not specified.
WILDFIRE_DEFAULT_ACTION The default action (as specified by the vendor) is taken.
WILDFIRE_ALLOW The packet matching this rule will be allowed to transmit.
WILDFIRE_ALERT The packet matching this rule will be allowed to transmit, but a threat_log entry will be sent to the consumer project.
WILDFIRE_DENY The packet matching this rule will be dropped, and a threat_log entry will be sent to the consumer project.

WildfireInlineMlOverride

Defines what action to take for WildFire Inline ML threats per protocol.

JSON representation 
{
  "protocol": enum (WildfireProtocol),
  "action": enum (WildfireThreatAction)
}
Fields
protocol

enum (WildfireProtocol)

Required. Protocol to match for WildFire Inline ML override.
action

enum (WildfireThreatAction)

Required. The action to take for WildFire Inline ML override.

WildfireInlineMlSettings

Defines the settings for WildFire Inline ML analysis.

JSON representation 
{
  "inlineMlConfigs": [
    {
      object (InlineMlConfig)
    }
  ],
  "fileExceptions": [
    {
      object (WildfireInlineMlFileException)
    }
  ]
}
Fields
inlineMlConfigs[]

object (InlineMlConfig)

Optional. List of Inline ML configs to enable in WildFire Inline ML analysis.
fileExceptions[]

object (WildfireInlineMlFileException)

Optional. List of files to exclude from WildFire Inline ML analysis.

InlineMlConfig

Configuration for WildFire Inline ML analysis per file type.

JSON representation 
{
  "fileType": enum (InlineMlFileType),
  "action": enum (InlineMlAction)
}
Fields
fileType

enum (InlineMlFileType)

Required. File type to configure Inline ML for.
action

enum (InlineMlAction)

Required. Action to take when a threat is detected using Inline ML.

InlineMlFileType

Available inline ML file types.

Enums
INLINE_ML_CONFIG_UNSPECIFIED Inline ML config not specified.
WINDOWS_EXECUTABLE Enable machine learning engine to dynamically detect malicious PE files.
POWERSHELL_SCRIPT1 Enable machine learning engine to dynamically identify malicious PowerShell scripts with known length.
POWERSHELL_SCRIPT2 Enable machine learning engine to dynamically identify malicious PowerShell script without known length.
ELF Enable machine learning engine to dynamically detect malicious ELF files.
MS_OFFICE Enable machine learning engine to dynamically detect malicious MSOffice (97-03) files.
SHELL Enable machine learning engine to dynamically detect malicious Shell files.
OOXML Enable machine learning engine to dynamically detect malicious Open Office XML files.
MACHO Enable machine learning engine to dynamically detect malicious Mach-O files.

InlineMlAction

WildFire inline ML action override.

Enums
INLINE_ML_ACTION_UNSPECIFIED Inline ML threat action not specified.
DISABLE Disable WildFire Inline ML for the associated file type.
ALERT Enable WildFire Inline ML for the associated file type. Overrides any protocol level settings with action stricter than ALERT to ALERT so that the malicious files detected generate a threat log to the consumer project but are not blocked.
ENABLE Enable WildFire Inline ML for the associated file type, malicious files detected will be blocked.

WildfireInlineMlFileException

Defines the file to exclude from WildFire Inline ML analysis.

JSON representation 
{
  "partialHash": string,
  "filename": string
}
Fields
partialHash

string

Required. Machine learning partial hash of the file to exclude from WildFire Inline ML analysis.
filename

string

Optional. Name of the file to exclude from WildFire Inline ML analysis.

WildfireThreatOverride

Defines what action to take for a specific WildFire threatId match.

JSON representation 
{
  "threatId": string,
  "action": enum (WildfireThreatAction)
}
Fields
threatId

string

Required. Threat ID to match.
action

enum (WildfireThreatAction)

Required. Threat action override.

ProfileType

The possible types that the SecurityProfile resource can configure.

Enums
PROFILE_TYPE_UNSPECIFIED Profile type not specified.
THREAT_PREVENTION Profile type for threat prevention.
CUSTOM_MIRRORING Profile type for packet mirroring v2
CUSTOM_INTERCEPT Profile type for TPPI.
URL_FILTERING Profile type for URL filtering.
WILDFIRE_ANALYSIS Profile type for WildFire Analysis.

Methods

create

 Creates a new SecurityProfile in a given organization and location.

delete

 Deletes a single SecurityProfile.

get

 Gets details of a single SecurityProfile.

list

 Lists SecurityProfiles in a given organization and location.

patch

 Updates the parameters of a single SecurityProfile.