google-cloud-chronicle-v1 0.8.0 → 0.9.0

data/lib/google/cloud/chronicle/v1/findings_refinement_service/rest.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+require "gapic/rest"
+require "gapic/config"
+require "gapic/config/method"
+
+require "google/cloud/chronicle/v1/version"
+
+require "google/cloud/chronicle/v1/findings_refinement_service/credentials"
+require "google/cloud/chronicle/v1/findings_refinement_service/paths"
+require "google/cloud/chronicle/v1/findings_refinement_service/rest/client"
+
+module Google
+  module Cloud
+    module Chronicle
+      module V1
+        ##
+        # FindingsRefinementService provides an interface for filtering out
+        # findings that are unlikely to be real threats to prevent them
+        # from triggering alerts or notifications.
+        #
+        # To load this service and instantiate a REST client:
+        #
+        #     require "google/cloud/chronicle/v1/findings_refinement_service/rest"
+        #     client = ::Google::Cloud::Chronicle::V1::FindingsRefinementService::Rest::Client.new
+        #
+        module FindingsRefinementService
+          # Client for the REST transport
+          module Rest
+          end
+        end
+      end
+    end
+  end
+end
+
+helper_path = ::File.join __dir__, "rest", "helpers.rb"
+require "google/cloud/chronicle/v1/findings_refinement_service/rest/helpers" if ::File.file? helper_path

data/lib/google/cloud/chronicle/v1/findings_refinement_service.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+require "gapic/common"
+require "gapic/config"
+require "gapic/config/method"
+
+require "google/cloud/chronicle/v1/version"
+
+require "google/cloud/chronicle/v1/findings_refinement_service/credentials"
+require "google/cloud/chronicle/v1/findings_refinement_service/paths"
+require "google/cloud/chronicle/v1/findings_refinement_service/client"
+require "google/cloud/chronicle/v1/findings_refinement_service/rest"
+
+module Google
+  module Cloud
+    module Chronicle
+      module V1
+        ##
+        # FindingsRefinementService provides an interface for filtering out
+        # findings that are unlikely to be real threats to prevent them
+        # from triggering alerts or notifications.
+        #
+        # @example Load this service and instantiate a gRPC client
+        #
+        #     require "google/cloud/chronicle/v1/findings_refinement_service"
+        #     client = ::Google::Cloud::Chronicle::V1::FindingsRefinementService::Client.new
+        #
+        # @example Load this service and instantiate a REST client
+        #
+        #     require "google/cloud/chronicle/v1/findings_refinement_service/rest"
+        #     client = ::Google::Cloud::Chronicle::V1::FindingsRefinementService::Rest::Client.new
+        #
+        module FindingsRefinementService
+        end
+      end
+    end
+  end
+end
+
+helper_path = ::File.join __dir__, "findings_refinement_service", "helpers.rb"
+require "google/cloud/chronicle/v1/findings_refinement_service/helpers" if ::File.file? helper_path

data/lib/google/cloud/chronicle/v1/findings_refinement_services_pb.rb

@@ -0,0 +1,63 @@
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# Source: google/cloud/chronicle/v1/findings_refinement.proto for package 'Google.Cloud.Chronicle.V1'
+# Original file comments:
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'grpc'
+require 'google/cloud/chronicle/v1/findings_refinement_pb'
+
+module Google
+  module Cloud
+    module Chronicle
+      module V1
+        module FindingsRefinementService
+          # FindingsRefinementService provides an interface for filtering out
+          # findings that are unlikely to be real threats to prevent them
+          # from triggering alerts or notifications.
+          class Service
+
+            include ::GRPC::GenericService
+
+            self.marshal_class_method = :encode
+            self.unmarshal_class_method = :decode
+            self.service_name = 'google.cloud.chronicle.v1.FindingsRefinementService'
+
+            # Gets a single findings refinement.
+            rpc :GetFindingsRefinement, ::Google::Cloud::Chronicle::V1::GetFindingsRefinementRequest, ::Google::Cloud::Chronicle::V1::FindingsRefinement
+            # Lists a collection of findings refinements.
+            rpc :ListFindingsRefinements, ::Google::Cloud::Chronicle::V1::ListFindingsRefinementsRequest, ::Google::Cloud::Chronicle::V1::ListFindingsRefinementsResponse
+            # Creates a new findings refinement.
+            rpc :CreateFindingsRefinement, ::Google::Cloud::Chronicle::V1::CreateFindingsRefinementRequest, ::Google::Cloud::Chronicle::V1::FindingsRefinement
+            # Updates a findings refinement.
+            rpc :UpdateFindingsRefinement, ::Google::Cloud::Chronicle::V1::UpdateFindingsRefinementRequest, ::Google::Cloud::Chronicle::V1::FindingsRefinement
+            # Gets a findings refinement deployment.
+            rpc :GetFindingsRefinementDeployment, ::Google::Cloud::Chronicle::V1::GetFindingsRefinementDeploymentRequest, ::Google::Cloud::Chronicle::V1::FindingsRefinementDeployment
+            # Updates a findings refinement deployment.
+            rpc :UpdateFindingsRefinementDeployment, ::Google::Cloud::Chronicle::V1::UpdateFindingsRefinementDeploymentRequest, ::Google::Cloud::Chronicle::V1::FindingsRefinementDeployment
+            # Lists all findings refinement deployments.
+            rpc :ListAllFindingsRefinementDeployments, ::Google::Cloud::Chronicle::V1::ListAllFindingsRefinementDeploymentsRequest, ::Google::Cloud::Chronicle::V1::ListAllFindingsRefinementDeploymentsResponse
+            # Returns findings refinement activity for a specific findings refinement.
+            rpc :ComputeFindingsRefinementActivity, ::Google::Cloud::Chronicle::V1::ComputeFindingsRefinementActivityRequest, ::Google::Cloud::Chronicle::V1::ComputeFindingsRefinementActivityResponse
+            # Returns findings refinement activity for all findings refinements.
+            rpc :ComputeAllFindingsRefinementActivities, ::Google::Cloud::Chronicle::V1::ComputeAllFindingsRefinementActivitiesRequest, ::Google::Cloud::Chronicle::V1::ComputeAllFindingsRefinementActivitiesResponse
+          end
+
+          Stub = Service.rpc_stub_class
+        end
+      end
+    end
+  end
+end

data/lib/google/cloud/chronicle/v1/rest.rb

@@ -24,6 +24,7 @@ require "google/cloud/chronicle/v1/data_table_service/rest"
 require "google/cloud/chronicle/v1/entity_service/rest"
 require "google/cloud/chronicle/v1/native_dashboard_service/rest"
 require "google/cloud/chronicle/v1/featured_content_native_dashboard_service/rest"
+require "google/cloud/chronicle/v1/findings_refinement_service/rest"
 require "google/cloud/chronicle/v1/instance_service/rest"
 require "google/cloud/chronicle/v1/reference_list_service/rest"
 require "google/cloud/chronicle/v1/rule_service/rest"

data/lib/google/cloud/chronicle/v1/version.rb

@@ -21,7 +21,7 @@ module Google
   module Cloud
     module Chronicle
       module V1
-        VERSION = "0.8.0"
+        VERSION = "0.9.0"
       end
     end
   end

data/lib/google/cloud/chronicle/v1.rb

@@ -24,6 +24,7 @@ require "google/cloud/chronicle/v1/data_table_service"
 require "google/cloud/chronicle/v1/entity_service"
 require "google/cloud/chronicle/v1/native_dashboard_service"
 require "google/cloud/chronicle/v1/featured_content_native_dashboard_service"
+require "google/cloud/chronicle/v1/findings_refinement_service"
 require "google/cloud/chronicle/v1/instance_service"
 require "google/cloud/chronicle/v1/reference_list_service"
 require "google/cloud/chronicle/v1/rule_service"

data/proto_docs/google/cloud/chronicle/v1/findings_refinement.rb

@@ -0,0 +1,439 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module Chronicle
+      module V1
+        # Represents a set of logic conditions used to refine various types of
+        # findings such as curated rule detections.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Full resource name for the findings refinement.
+        #     Format:
+        #     projects/\\{project}/locations/\\{region}/instances/\\{instance}/findingsRefinements/\\{findings_refinement}
+        # @!attribute [rw] display_name
+        #   @return [::String]
+        #     Display name of the findings refinement.
+        # @!attribute [rw] type
+        #   @return [::Google::Cloud::Chronicle::V1::FindingsRefinementType]
+        #     The type of findings refinement.
+        # @!attribute [r] create_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The timestamp of when the findings refinement was created.
+        # @!attribute [r] update_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The timestamp of when the findings refinement was last
+        #     updated.
+        # @!attribute [rw] query
+        #   @return [::String]
+        #     The query for the findings refinement. Works in conjunction with the type
+        #     field to determine the findings refinement behavior. The syntax of this
+        #     query is the same as a UDM search string. See the following for more
+        #     information:
+        #     https://cloud.google.com/chronicle/docs/investigation/udm-search
+        # @!attribute [rw] outcome_filters
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::OutcomeFilter>]
+        #     Optional. The outcome filters for the findings refinement. These allow you
+        #     to specify filters that are applied to the outcome variables in the
+        #     detection. All filters must be true for a detection to match the findings
+        #     refinement.
+        class FindingsRefinement
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # The FindingsRefinementDeployment resource represents the deployment state of
+        # a findings refinement.
+        # @!attribute [rw] detection_exclusion_application
+        #   @return [::Google::Cloud::Chronicle::V1::DetectionExclusionApplication]
+        #     The resources which the detection exclusion is applied to.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. The resource name of the findings refinement deployment.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/findingsRefinements/\\{findings_refinement}/deployment
+        # @!attribute [rw] enabled
+        #   @return [::Boolean]
+        #     Whether the findings refinement is currently deployed continuously against
+        #     incoming findings.
+        # @!attribute [rw] archived
+        #   @return [::Boolean]
+        #     The archive state of the findings refinement deployment.
+        #     Cannot be set to true unless enabled is set to false.
+        #     If currently set to true, enabled cannot be updated to true.
+        # @!attribute [r] update_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The timestamp when the findings refinement deployment was last
+        #     updated.
+        class FindingsRefinementDeployment
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Describes the detectors a detection exclusion is applied to.
+        # @!attribute [rw] curated_rule_sets
+        #   @return [::Array<::String>]
+        #     The CuratedRuleSets this detection exclusion applies to.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/curatedRuleSetCategories/\\{category}/curatedRuleSets/\\{rule_set}
+        # @!attribute [rw] curated_rules
+        #   @return [::Array<::String>]
+        #     The CuratedRules this detection exclusion applies to.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/curatedRules/\\{rule}
+        # @!attribute [rw] rules
+        #   @return [::Array<::String>]
+        #     Optional. The Rules this detection exclusion applies to.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/rules/\\{rule}
+        # @!attribute [r] deleted_curated_rule_sets
+        #   @return [::Array<::String>]
+        #     Output only. The deleted CuratedRuleSets this detection exclusion applies
+        #     to. Indicates to the customer that the detection exclusion no longer
+        #     applies to the rule sets, so the detection exclusion should be updated.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/curatedRuleSetCategories/\\{category}/curatedRuleSets/\\{rule_set}
+        class DetectionExclusionApplication
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # The activity for a specific findings refinement.
+        # @!attribute [rw] detection_exclusion_activity
+        #   @return [::Google::Cloud::Chronicle::V1::DetectionExclusionActivity]
+        #     The activity for the detection exclusion.
+        # @!attribute [rw] findings_refinement
+        #   @return [::String]
+        #     Required. Full resource name for the findings refinement this activity
+        #     corresponds to. Format:
+        #     projects/\\{project}/locations/\\{region}/instances/\\{instance}/findingsRefinements/\\{findings_refinement}
+        class FindingsRefinementActivity
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # The activity for a findings refinement that is a detection exclusion. The
+        # activity is broken down per detector.
+        # @!attribute [rw] detection_exclusion_detector_activities
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::DetectionExclusionActivity::DetectionExclusionDetectorActivity>]
+        #     The activity for the detection exclusion broken down by detector.
+        class DetectionExclusionActivity
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # The activity for a findings refinement that is a detection exclusion broken
+          # down for one specific detector.
+          # @!attribute [rw] curated_rule
+          #   @return [::String]
+          #     Full resource name for the curated rule this activity corresponds to.
+          #     Format:
+          #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/curatedRules/\\{rule}
+          #
+          #     Note: The following fields are mutually exclusive: `curated_rule`, `curated_rule_set`, `rule`, `deleted_curated_rule_set`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] curated_rule_set
+          #   @return [::String]
+          #     Full resource name for the curated rule set this activity corresponds
+          #     to. This field will only be set if the customer has access to the
+          #     curated rule set the exclusion is applied to.
+          #     Format:
+          #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/curatedRuleSetCategories/\\{curated_rule_set_category}/curatedRuleSets/\\{curated_rule_set}
+          #
+          #     Note: The following fields are mutually exclusive: `curated_rule_set`, `curated_rule`, `rule`, `deleted_curated_rule_set`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] rule
+          #   @return [::String]
+          #     Full resource name for the rule this activity corresponds to.
+          #     Format:
+          #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/rules/\\{rule}
+          #
+          #     Note: The following fields are mutually exclusive: `rule`, `curated_rule`, `curated_rule_set`, `deleted_curated_rule_set`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] deleted_curated_rule_set
+          #   @return [::String]
+          #     Full resource name for the deleted curated rule set this activity
+          #     corresponds to. This field will only be set if the customer does
+          #     not have access to the curated rule set the exclusion is applied to.
+          #     Format:
+          #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/curatedRuleSetCategories/\\{curated_rule_set_category}/curatedRuleSets/\\{curated_rule_set}
+          #
+          #     Note: The following fields are mutually exclusive: `deleted_curated_rule_set`, `curated_rule`, `curated_rule_set`, `rule`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] excluded_detection_count
+          #   @return [::Integer]
+          #     The number of detections for the detector that were excluded by the
+          #     detection exclusion.
+          # @!attribute [rw] total_detection_count
+          #   @return [::Integer]
+          #     The total number of detections found by the detector. This includes both
+          #     excluded detections and non-excluded detections.
+          class DetectionExclusionDetectorActivity
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+        end
+
+        # Request message for GetFindingsRefinement method.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. The name of the findings refinement to retrieve.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/findingsRefinements/\\{findings_refinement}
+        class GetFindingsRefinementRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for ListFindingsRefinements method.
+        # @!attribute [rw] parent
+        #   @return [::String]
+        #     Required. The parent, which owns this collection of findings refinements.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}
+        # @!attribute [rw] page_size
+        #   @return [::Integer]
+        #     The maximum number of findings refinements to return. The service may
+        #     return fewer than this value. If unspecified, at most 100 rules will be
+        #     returned. The maximum value is 1000; values above 1000 will be coerced to
+        #     1000.
+        # @!attribute [rw] page_token
+        #   @return [::String]
+        #     A page token, received from a previous `ListFindingsRefinements` call.
+        #     Provide this to retrieve the subsequent page.
+        class ListFindingsRefinementsRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Response message for ListFindingsRefinements method.
+        # @!attribute [rw] findings_refinements
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::FindingsRefinement>]
+        #     List of findings refinements.
+        # @!attribute [rw] next_page_token
+        #   @return [::String]
+        #     A token, which can be sent as `page_token` to retrieve the next page. If
+        #     this field is omitted, there are no subsequent pages.
+        class ListFindingsRefinementsResponse
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for CreateFindingsRefinement method.
+        # @!attribute [rw] parent
+        #   @return [::String]
+        #     Required. The parent resource where this findings refinement will be
+        #     created. Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}
+        # @!attribute [rw] findings_refinement
+        #   @return [::Google::Cloud::Chronicle::V1::FindingsRefinement]
+        #     Required. The findings refinement to create.
+        class CreateFindingsRefinementRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for UpdateFindingsRefinement method.
+        # @!attribute [rw] findings_refinement
+        #   @return [::Google::Cloud::Chronicle::V1::FindingsRefinement]
+        #     Required. The findings refinement to update.
+        #
+        #     The findings refinement's `name` field is used to identify the findings
+        #     refinement to update.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/findingsRefinements/\\{findings_refinement}
+        # @!attribute [rw] update_mask
+        #   @return [::Google::Protobuf::FieldMask]
+        #     Optional. The list of fields to update. If `*` is provided, all fields will
+        #     be updated.
+        class UpdateFindingsRefinementRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for GetFindingsRefinementDeployment method.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. The name of the findings refinement to retrieve.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/findingsRefinements/\\{findings_refinement}/deployment
+        class GetFindingsRefinementDeploymentRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for UpdateFindingsRefinementDeployment method.
+        # @!attribute [rw] findings_refinement_deployment
+        #   @return [::Google::Cloud::Chronicle::V1::FindingsRefinementDeployment]
+        #     Required. The findings refinement deployment to update.
+        #
+        #     The findings refinement deployment's `name` field is used to identify the
+        #     findings refinement deployment to update.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/findingsRefinements/\\{findings_refinement}/deployment
+        # @!attribute [rw] update_mask
+        #   @return [::Google::Protobuf::FieldMask]
+        #     Required. The list of fields to update. If `*` is provided, all fields will
+        #     be updated.
+        class UpdateFindingsRefinementDeploymentRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for ListAllFindingsRefinementDeployments method.
+        # @!attribute [rw] instance
+        #   @return [::String]
+        #     Required. The name of the parent resource, which is the SecOps instance to
+        #     list all findings refinement deployments over. Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}
+        # @!attribute [rw] page_size
+        #   @return [::Integer]
+        #     The maximum number of findings refinement deployments to return. The
+        #     service may return fewer than this value. If unspecified, at most 100 rule
+        #     deployments will be returned. The maximum value is 1000; values above 1000
+        #     will be coerced to 1000.
+        # @!attribute [rw] page_token
+        #   @return [::String]
+        #     A page token, received from a previous
+        #     `ListAllFindingsRefinementDeployments` call. Provide this to retrieve the
+        #     subsequent page.
+        #
+        #     When paginating, all other parameters provided to
+        #     `ListAllFindingsRefinementDeployments` must match the call that provided
+        #     the page token.
+        # @!attribute [rw] filter
+        #   @return [::String]
+        #     A filter that can be used to retrieve specific findings refinement
+        #     deployments.
+        #     Only the following filters are allowed:
+        #     detection_exclusion_application.curated_rule_sets:"<curated_rule_set_name>"",
+        #     detection_exclusion_application.curated_rules:"<curated_rule_name>"
+        class ListAllFindingsRefinementDeploymentsRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Response message for ListAllFindingsRefinementDeployments method.
+        # @!attribute [rw] all_findings_refinement_deployments
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::FindingsRefinementDeployment>]
+        #     List of all findings refinement deployments.
+        # @!attribute [rw] next_page_token
+        #   @return [::String]
+        #     A token, which can be sent as `page_token` to retrieve the next page. If
+        #     this field is omitted, there are no subsequent pages.
+        class ListAllFindingsRefinementDeploymentsResponse
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Outcome filter for the findings refinement. This is used to filter the
+        # findings refinement based on the outcome variable values.
+        # @!attribute [rw] outcome_variable
+        #   @return [::String]
+        #     Required. The outcome variable name.
+        # @!attribute [rw] outcome_value
+        #   @return [::String]
+        #     Required. The value of the outcome variable to match.
+        # @!attribute [rw] outcome_filter_operator
+        #   @return [::Google::Cloud::Chronicle::V1::OutcomeFilter::Operator]
+        #     Required. The operator to be applied to the outcome variable.
+        class OutcomeFilter
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # The operator to compare the outcome variable value with the outcome value
+          # in the outcome filter.
+          module Operator
+            # The operator is unspecified.
+            OPERATOR_UNSPECIFIED = 0
+
+            # The outcome variable value must be equal to the outcome value in the
+            # outcome filter.
+            EQUAL = 1
+
+            # The outcome variable value must contain the outcome value in the
+            # outcome filter.
+            CONTAINS = 2
+
+            # The outcome variable value must match the outcome value regex in the
+            # outcome filter.
+            MATCHES_REGEX = 3
+
+            # The outcome variable value must be a valid IP address in the outcome
+            # filter value CIDR range.
+            MATCHES_CIDR = 4
+          end
+        end
+
+        # Request message for ComputeFindingsRefinementActivity method.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. Full resource name for the findings refinement to fetch the
+        #     activity for. Format:
+        #     projects/\\{project}/locations/\\{region}/instances/\\{instance}/findingsRefinements/\\{findings_refinement}
+        # @!attribute [rw] interval
+        #   @return [::Google::Type::Interval]
+        #     The time interval the activity is measured over.
+        class ComputeFindingsRefinementActivityRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Response message for ComputeFindingsRefinementActivity method.
+        # @!attribute [rw] activity
+        #   @return [::Google::Cloud::Chronicle::V1::FindingsRefinementActivity]
+        #     The activity for the findings refinement.
+        class ComputeFindingsRefinementActivityResponse
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for ComputeAllFindingsRefinementActivities method.
+        # @!attribute [rw] instance
+        #   @return [::String]
+        #     Required. The ID of the Instance to retrieve counts for.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}
+        # @!attribute [rw] interval
+        #   @return [::Google::Type::Interval]
+        #     The time interval the activity is measured over.
+        class ComputeAllFindingsRefinementActivitiesRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Response message for ComputeAllFindingsRefinementActivities method.
+        # @!attribute [rw] activities
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::FindingsRefinementActivity>]
+        #     The activities of all findings refinements.
+        class ComputeAllFindingsRefinementActivitiesResponse
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # The type of findings refinement, which determines what the findings
+        # refinement runs over and the mechanism by which it runs.
+        module FindingsRefinementType
+          # The findings refinement type is unspecified.
+          FINDINGS_REFINEMENT_TYPE_UNSPECIFIED = 0
+
+          # Indicates that the findings refinement is a detection exclusion and
+          # should exclude matching detections.
+          DETECTION_EXCLUSION = 1
+        end
+      end
+    end
+  end
+end