google-cloud-network_security-v1 0.a → 0.1.0

data/proto_docs/google/cloud/networksecurity/v1/security_profile_group.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module NetworkSecurity
+      module V1
+        # SecurityProfileGroup is a resource that defines the behavior for various
+        # ProfileTypes.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Immutable. Identifier. Name of the SecurityProfileGroup resource. It
+        #     matches pattern
+        #     `projects|organizations/*/locations/{location}/securityProfileGroups/{security_profile_group}`.
+        # @!attribute [rw] description
+        #   @return [::String]
+        #     Optional. An optional description of the profile group. Max length 2048
+        #     characters.
+        # @!attribute [r] create_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. Resource creation timestamp.
+        # @!attribute [r] update_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. Last resource update timestamp.
+        # @!attribute [r] etag
+        #   @return [::String]
+        #     Output only. This checksum is computed by the server based on the value of
+        #     other fields, and may be sent on update and delete requests to ensure the
+        #     client has an up-to-date value before proceeding.
+        # @!attribute [r] data_path_id
+        #   @return [::Integer]
+        #     Output only. Identifier used by the data-path. Unique within `{container,
+        #     location}`.
+        # @!attribute [rw] labels
+        #   @return [::Google::Protobuf::Map{::String => ::String}]
+        #     Optional. Labels as key value pairs.
+        # @!attribute [rw] threat_prevention_profile
+        #   @return [::String]
+        #     Optional. Reference to a SecurityProfile with the ThreatPrevention
+        #     configuration.
+        # @!attribute [rw] custom_mirroring_profile
+        #   @return [::String]
+        #     Optional. Reference to a SecurityProfile with the CustomMirroring
+        #     configuration.
+        # @!attribute [rw] custom_intercept_profile
+        #   @return [::String]
+        #     Optional. Reference to a SecurityProfile with the CustomIntercept
+        #     configuration.
+        # @!attribute [rw] url_filtering_profile
+        #   @return [::String]
+        #     Optional. Reference to a SecurityProfile with the UrlFiltering
+        #     configuration.
+        class SecurityProfileGroup
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # @!attribute [rw] key
+          #   @return [::String]
+          # @!attribute [rw] value
+          #   @return [::String]
+          class LabelsEntry
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+        end
+
+        # SecurityProfile is a resource that defines the behavior for one of many
+        # ProfileTypes.
+        # @!attribute [rw] threat_prevention_profile
+        #   @return [::Google::Cloud::NetworkSecurity::V1::ThreatPreventionProfile]
+        #     The threat prevention configuration for the SecurityProfile.
+        #
+        #     Note: The following fields are mutually exclusive: `threat_prevention_profile`, `custom_mirroring_profile`, `custom_intercept_profile`, `url_filtering_profile`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] custom_mirroring_profile
+        #   @return [::Google::Cloud::NetworkSecurity::V1::CustomMirroringProfile]
+        #     The custom Packet Mirroring v2 configuration for the SecurityProfile.
+        #
+        #     Note: The following fields are mutually exclusive: `custom_mirroring_profile`, `threat_prevention_profile`, `custom_intercept_profile`, `url_filtering_profile`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] custom_intercept_profile
+        #   @return [::Google::Cloud::NetworkSecurity::V1::CustomInterceptProfile]
+        #     The custom TPPI configuration for the SecurityProfile.
+        #
+        #     Note: The following fields are mutually exclusive: `custom_intercept_profile`, `threat_prevention_profile`, `custom_mirroring_profile`, `url_filtering_profile`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] url_filtering_profile
+        #   @return [::Google::Cloud::NetworkSecurity::V1::UrlFilteringProfile]
+        #     The URL filtering configuration for the SecurityProfile.
+        #
+        #     Note: The following fields are mutually exclusive: `url_filtering_profile`, `threat_prevention_profile`, `custom_mirroring_profile`, `custom_intercept_profile`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Immutable. Identifier. Name of the SecurityProfile resource. It matches
+        #     pattern
+        #     `projects|organizations/*/locations/{location}/securityProfiles/{security_profile}`.
+        # @!attribute [rw] description
+        #   @return [::String]
+        #     Optional. An optional description of the profile. Max length 512
+        #     characters.
+        # @!attribute [r] create_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. Resource creation timestamp.
+        # @!attribute [r] update_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. Last resource update timestamp.
+        # @!attribute [r] etag
+        #   @return [::String]
+        #     Output only. This checksum is computed by the server based on the value of
+        #     other fields, and may be sent on update and delete requests to ensure the
+        #     client has an up-to-date value before proceeding.
+        # @!attribute [rw] labels
+        #   @return [::Google::Protobuf::Map{::String => ::String}]
+        #     Optional. Labels as key value pairs.
+        # @!attribute [rw] type
+        #   @return [::Google::Cloud::NetworkSecurity::V1::SecurityProfile::ProfileType]
+        #     Immutable. The single ProfileType that the SecurityProfile resource
+        #     configures.
+        class SecurityProfile
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # @!attribute [rw] key
+          #   @return [::String]
+          # @!attribute [rw] value
+          #   @return [::String]
+          class LabelsEntry
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # The possible types that the SecurityProfile resource can configure.
+          module ProfileType
+            # Profile type not specified.
+            PROFILE_TYPE_UNSPECIFIED = 0
+
+            # Profile type for threat prevention.
+            THREAT_PREVENTION = 1
+
+            # Profile type for packet mirroring v2
+            CUSTOM_MIRRORING = 2
+
+            # Profile type for TPPI.
+            CUSTOM_INTERCEPT = 3
+
+            # Profile type for URL filtering.
+            URL_FILTERING = 5
+          end
+        end
+      end
+    end
+  end
+end

data/proto_docs/google/cloud/networksecurity/v1/security_profile_group_intercept.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module NetworkSecurity
+      module V1
+        # CustomInterceptProfile defines in-band integration behavior (intercept).
+        # It is used by firewall rules with an APPLY_SECURITY_PROFILE_GROUP action.
+        # @!attribute [rw] intercept_endpoint_group
+        #   @return [::String]
+        #     Required. The target InterceptEndpointGroup.
+        #     When a firewall rule with this security profile attached matches a packet,
+        #     the packet will be intercepted to the location-local target in this group.
+        class CustomInterceptProfile
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+      end
+    end
+  end
+end

data/proto_docs/google/cloud/networksecurity/v1/security_profile_group_mirroring.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module NetworkSecurity
+      module V1
+        # CustomMirroringProfile defines out-of-band integration behavior (mirroring).
+        # It is used by mirroring rules with a MIRROR action.
+        # @!attribute [rw] mirroring_endpoint_group
+        #   @return [::String]
+        #     Required. Immutable. The target MirroringEndpointGroup.
+        #     When a mirroring rule with this security profile attached matches a packet,
+        #     a replica will be mirrored to the location-local target in this group.
+        class CustomMirroringProfile
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+      end
+    end
+  end
+end

data/proto_docs/google/cloud/networksecurity/v1/security_profile_group_service.rb

@@ -0,0 +1,211 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module NetworkSecurity
+      module V1
+        # Request used with the ListSecurityProfileGroups method.
+        # @!attribute [rw] parent
+        #   @return [::String]
+        #     Required. The project or organization and location from which the
+        #     SecurityProfileGroups should be listed, specified in the format
+        #     `projects|organizations/*/locations/{location}`.
+        # @!attribute [rw] page_size
+        #   @return [::Integer]
+        #     Optional. Maximum number of SecurityProfileGroups to return per call.
+        # @!attribute [rw] page_token
+        #   @return [::String]
+        #     Optional. The value returned by the last
+        #     `ListSecurityProfileGroupsResponse` Indicates that this is a
+        #     continuation of a prior `ListSecurityProfileGroups` call, and
+        #     that the system should return the next page of data.
+        class ListSecurityProfileGroupsRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Response returned by the ListSecurityProfileGroups method.
+        # @!attribute [rw] security_profile_groups
+        #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::SecurityProfileGroup>]
+        #     List of SecurityProfileGroups resources.
+        # @!attribute [rw] next_page_token
+        #   @return [::String]
+        #     If there might be more results than those appearing in this response, then
+        #     `next_page_token` is included. To get the next set of results, call this
+        #     method again using the value of `next_page_token` as `page_token`.
+        class ListSecurityProfileGroupsResponse
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request used by the GetSecurityProfileGroup method.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. A name of the SecurityProfileGroup to get. Must be in the format
+        #     `projects|organizations/*/locations/{location}/securityProfileGroups/{security_profile_group}`.
+        class GetSecurityProfileGroupRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request used by the CreateSecurityProfileGroup method.
+        # @!attribute [rw] parent
+        #   @return [::String]
+        #     Required. The parent resource of the SecurityProfileGroup. Must be in the
+        #     format `projects|organizations/*/locations/{location}`.
+        # @!attribute [rw] security_profile_group_id
+        #   @return [::String]
+        #     Required. Short name of the SecurityProfileGroup resource to be created.
+        #     This value should be 1-63 characters long, containing only
+        #     letters, numbers, hyphens, and underscores, and should not start
+        #     with a number. E.g. "security_profile_group1".
+        # @!attribute [rw] security_profile_group
+        #   @return [::Google::Cloud::NetworkSecurity::V1::SecurityProfileGroup]
+        #     Required. SecurityProfileGroup resource to be created.
+        class CreateSecurityProfileGroupRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request used by the UpdateSecurityProfileGroup method.
+        # @!attribute [rw] update_mask
+        #   @return [::Google::Protobuf::FieldMask]
+        #     Required. Field mask is used to specify the fields to be overwritten in the
+        #     SecurityProfileGroup resource by the update.
+        #     The fields specified in the update_mask are relative to the resource, not
+        #     the full request. A field will be overwritten if it is in the mask.
+        # @!attribute [rw] security_profile_group
+        #   @return [::Google::Cloud::NetworkSecurity::V1::SecurityProfileGroup]
+        #     Required. Updated SecurityProfileGroup resource.
+        class UpdateSecurityProfileGroupRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request used by the DeleteSecurityProfileGroup method.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. A name of the SecurityProfileGroup to delete. Must be in the
+        #     format
+        #     `projects|organizations/*/locations/{location}/securityProfileGroups/{security_profile_group}`.
+        # @!attribute [rw] etag
+        #   @return [::String]
+        #     Optional. If client provided etag is out of date, delete will return
+        #     FAILED_PRECONDITION error.
+        class DeleteSecurityProfileGroupRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request used with the ListSecurityProfiles method.
+        # @!attribute [rw] parent
+        #   @return [::String]
+        #     Required. The project or organization and location from which the
+        #     SecurityProfiles should be listed, specified in the format
+        #     `projects|organizations/*/locations/{location}`.
+        # @!attribute [rw] page_size
+        #   @return [::Integer]
+        #     Optional. Maximum number of SecurityProfiles to return per call.
+        # @!attribute [rw] page_token
+        #   @return [::String]
+        #     Optional. The value returned by the last
+        #     `ListSecurityProfilesResponse` Indicates that this is a continuation of a
+        #     prior `ListSecurityProfiles` call, and that the system should return the
+        #     next page of data.
+        class ListSecurityProfilesRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Response returned by the ListSecurityProfiles method.
+        # @!attribute [rw] security_profiles
+        #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::SecurityProfile>]
+        #     List of SecurityProfile resources.
+        # @!attribute [rw] next_page_token
+        #   @return [::String]
+        #     If there might be more results than those appearing in this response, then
+        #     `next_page_token` is included. To get the next set of results, call this
+        #     method again using the value of `next_page_token` as `page_token`.
+        class ListSecurityProfilesResponse
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request used by the GetSecurityProfile method.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. A name of the SecurityProfile to get. Must be in the format
+        #     `projects|organizations/*/locations/{location}/securityProfiles/{security_profile_id}`.
+        class GetSecurityProfileRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request used by the CreateSecurityProfile method.
+        # @!attribute [rw] parent
+        #   @return [::String]
+        #     Required. The parent resource of the SecurityProfile. Must be in the format
+        #     `projects|organizations/*/locations/{location}`.
+        # @!attribute [rw] security_profile_id
+        #   @return [::String]
+        #     Required. Short name of the SecurityProfile resource to be created. This
+        #     value should be 1-63 characters long, containing only letters, numbers,
+        #     hyphens, and underscores, and should not start with a number. E.g.
+        #     "security_profile1".
+        # @!attribute [rw] security_profile
+        #   @return [::Google::Cloud::NetworkSecurity::V1::SecurityProfile]
+        #     Required. SecurityProfile resource to be created.
+        class CreateSecurityProfileRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request used by the UpdateSecurityProfile method.
+        # @!attribute [rw] update_mask
+        #   @return [::Google::Protobuf::FieldMask]
+        #     Required. Field mask is used to specify the fields to be overwritten in the
+        #     SecurityProfile resource by the update.
+        #     The fields specified in the update_mask are relative to the resource, not
+        #     the full request. A field will be overwritten if it is in the mask.
+        # @!attribute [rw] security_profile
+        #   @return [::Google::Cloud::NetworkSecurity::V1::SecurityProfile]
+        #     Required. Updated SecurityProfile resource.
+        class UpdateSecurityProfileRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request used by the DeleteSecurityProfile method.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. A name of the SecurityProfile to delete. Must be in the format
+        #     `projects|organizations/*/locations/{location}/securityProfiles/{security_profile_id}`.
+        # @!attribute [rw] etag
+        #   @return [::String]
+        #     Optional. If client provided etag is out of date, delete will return
+        #     FAILED_PRECONDITION error.
+        class DeleteSecurityProfileRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+      end
+    end
+  end
+end

data/proto_docs/google/cloud/networksecurity/v1/security_profile_group_threatprevention.rb

@@ -0,0 +1,193 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module NetworkSecurity
+      module V1
+        # ThreatPreventionProfile defines an action for specific threat signatures or
+        # severity levels.
+        # @!attribute [rw] severity_overrides
+        #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::SeverityOverride>]
+        #     Optional. Configuration for overriding threats actions by severity match.
+        # @!attribute [rw] threat_overrides
+        #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::ThreatOverride>]
+        #     Optional. Configuration for overriding threats actions by threat_id match.
+        #     If a threat is matched both by configuration provided in severity_overrides
+        #     and threat_overrides, the threat_overrides action is applied.
+        # @!attribute [rw] antivirus_overrides
+        #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AntivirusOverride>]
+        #     Optional. Configuration for overriding antivirus actions per protocol.
+        class ThreatPreventionProfile
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Defines what action to take for a specific severity match.
+        # @!attribute [rw] severity
+        #   @return [::Google::Cloud::NetworkSecurity::V1::Severity]
+        #     Required. Severity level to match.
+        # @!attribute [rw] action
+        #   @return [::Google::Cloud::NetworkSecurity::V1::ThreatAction]
+        #     Required. Threat action override.
+        class SeverityOverride
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Defines what action to take for a specific threat_id match.
+        # @!attribute [rw] threat_id
+        #   @return [::String]
+        #     Required. Vendor-specific ID of a threat to override.
+        # @!attribute [r] type
+        #   @return [::Google::Cloud::NetworkSecurity::V1::ThreatType]
+        #     Output only. Type of the threat (read only).
+        # @!attribute [rw] action
+        #   @return [::Google::Cloud::NetworkSecurity::V1::ThreatAction]
+        #     Required. Threat action override. For some threat types, only a subset of
+        #     actions applies.
+        class ThreatOverride
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Defines what action to take for antivirus threats per protocol.
+        # @!attribute [rw] protocol
+        #   @return [::Google::Cloud::NetworkSecurity::V1::Protocol]
+        #     Required. Protocol to match.
+        # @!attribute [rw] action
+        #   @return [::Google::Cloud::NetworkSecurity::V1::ThreatAction]
+        #     Required. Threat action override. For some threat types, only a subset of
+        #     actions applies.
+        class AntivirusOverride
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Severity level.
+        module Severity
+          # Severity level not specified.
+          SEVERITY_UNSPECIFIED = 0
+
+          # Suspicious events that do not pose an immediate threat, but that are
+          # reported to call attention to deeper problems that could possibly exist.
+          INFORMATIONAL = 1
+
+          # Warning-level threats that have very little impact on an organization's
+          # infrastructure. They usually require local or physical system access and
+          # may often result in victim privacy issues and information leakage.
+          LOW = 2
+
+          # Minor threats in which impact is minimized, that do not compromise the
+          # target or exploits that require an attacker to reside on the same local
+          # network as the victim, affect only non-standard configurations or obscure
+          # applications, or provide very limited access.
+          MEDIUM = 3
+
+          # Threats that have the ability to become critical but have mitigating
+          # factors; for example, they may be difficult to exploit, do not result in
+          # elevated privileges, or do not have a large victim pool.
+          HIGH = 4
+
+          # Serious threats, such as those that affect default installations of widely
+          # deployed software, result in root compromise of servers, and the exploit
+          # code is widely available to attackers. The attacker usually does not need
+          # any special authentication credentials or knowledge about the individual
+          # victims and the target does not need to be manipulated into performing any
+          # special functions.
+          CRITICAL = 5
+        end
+
+        # Type of threat.
+        module ThreatType
+          # Type of threat not specified.
+          THREAT_TYPE_UNSPECIFIED = 0
+
+          # Type of threat is not derivable from threat ID. An override will be
+          # created for all types. Firewall will ignore overridden signature ID's
+          # that don't exist in the specific type.
+          UNKNOWN = 1
+
+          # Threats related to system flaws that an attacker might otherwise attempt
+          # to exploit.
+          VULNERABILITY = 2
+
+          # Threats related to viruses and malware found in executables and file
+          # types.
+          ANTIVIRUS = 3
+
+          # Threats related to command-and-control (C2) activity, where spyware on an
+          # infected client is collecting data without the user's consent and/or
+          # communicating with a remote attacker.
+          SPYWARE = 4
+
+          # Threats related to DNS.
+          DNS = 5
+        end
+
+        # Threat action override.
+        module ThreatAction
+          # Threat action not specified.
+          THREAT_ACTION_UNSPECIFIED = 0
+
+          # The default action (as specified by the vendor) is taken.
+          DEFAULT_ACTION = 4
+
+          # The packet matching this rule will be allowed to transmit.
+          ALLOW = 1
+
+          # The packet matching this rule will be allowed to transmit, but a threat_log
+          # entry will be sent to the consumer project.
+          ALERT = 2
+
+          # The packet matching this rule will be dropped, and a threat_log entry will
+          # be sent to the consumer project.
+          DENY = 3
+        end
+
+        # Antivirus protocol.
+        module Protocol
+          # Protocol not specified.
+          PROTOCOL_UNSPECIFIED = 0
+
+          # SMTP protocol
+          SMTP = 1
+
+          # SMB protocol
+          SMB = 2
+
+          # POP3 protocol
+          POP3 = 3
+
+          # IMAP protocol
+          IMAP = 4
+
+          # HTTP2 protocol
+          HTTP2 = 5
+
+          # HTTP protocol
+          HTTP = 6
+
+          # FTP protocol
+          FTP = 7
+        end
+      end
+    end
+  end
+end