// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1alpha1;

import "google/api/field_behavior.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Alpha1";
option go_package = "cloud.google.com/go/networksecurity/apiv1alpha1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "SecurityProfileGroupThreatPreventionProto";
option java_package = "com.google.cloud.networksecurity.v1alpha1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1alpha1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1alpha1";

// Severity level.
enum Severity {
  // Severity level not specified.
  SEVERITY_UNSPECIFIED = 0;

  // Suspicious events that do not pose an immediate threat, but that are
  // reported to call attention to deeper problems that could possibly exist.
  INFORMATIONAL = 1;

  // Warning-level threats that have very little impact on an organization's
  // infrastructure. They usually require local or physical system access and
  // may often result in victim privacy issues and information leakage.
  LOW = 2;

  // Minor threats in which impact is minimized, that do not compromise the
  // target or exploits that require an attacker to reside on the same local
  // network as the victim, affect only non-standard configurations or obscure
  // applications, or provide very limited access.
  MEDIUM = 3;

  // Threats that have the ability to become critical but have mitigating
  // factors; for example, they may be difficult to exploit, do not result in
  // elevated privileges, or do not have a large victim pool.
  HIGH = 4;

  // Serious threats, such as those that affect default installations of widely
  // deployed software, result in root compromise of servers, and the exploit
  // code is widely available to attackers. The attacker usually does not need
  // any special authentication credentials or knowledge about the individual
  // victims and the target does not need to be manipulated into performing any
  // special functions.
  CRITICAL = 5;
}

// Type of threat.
enum ThreatType {
  // Type of threat not specified.
  THREAT_TYPE_UNSPECIFIED = 0;

  // Type of threat is not derivable from threat ID. An override will be
  // created for all types. Firewall will ignore overridden signature ID's
  // that don't exist in the specific type.
  UNKNOWN = 1;

  // Threats related to system flaws that an attacker might otherwise attempt
  // to exploit.
  VULNERABILITY = 2;

  // Threats related to viruses and malware found in executables and file
  // types.
  ANTIVIRUS = 3;

  // Threats related to command-and-control (C2) activity, where spyware on an
  // infected client is collecting data without the user's consent and/or
  // communicating with a remote attacker.
  SPYWARE = 4;

  // Threats related to DNS.
  DNS = 5;
}

// Threat action override.
enum ThreatAction {
  // Threat action not specified.
  THREAT_ACTION_UNSPECIFIED = 0;

  // The default action (as specified by the vendor) is taken.
  DEFAULT_ACTION = 4;

  // The packet matching this rule will be allowed to transmit.
  ALLOW = 1;

  // The packet matching this rule will be allowed to transmit, but a threat_log
  // entry will be sent to the consumer project.
  ALERT = 2;

  // The packet matching this rule will be dropped, and a threat_log entry will
  // be sent to the consumer project.
  DENY = 3;
}

// Antivirus protocol.
enum Protocol {
  // Protocol not specified.
  PROTOCOL_UNSPECIFIED = 0;

  // SMTP protocol
  SMTP = 1;

  // SMB protocol
  SMB = 2;

  // POP3 protocol
  POP3 = 3;

  // IMAP protocol
  IMAP = 4;

  // HTTP2 protocol
  HTTP2 = 5;

  // HTTP protocol
  HTTP = 6;

  // FTP protocol
  FTP = 7;
}

// ThreatPreventionProfile defines an action for specific threat signatures or
// severity levels.
message ThreatPreventionProfile {
  // Optional. Configuration for overriding threats actions by severity match.
  repeated SeverityOverride severity_overrides = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Configuration for overriding threats actions by threat_id match.
  // If a threat is matched both by configuration provided in severity_overrides
  // and threat_overrides, the threat_overrides action is applied.
  repeated ThreatOverride threat_overrides = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Configuration for overriding antivirus actions per protocol.
  repeated AntivirusOverride antivirus_overrides = 4
      [(google.api.field_behavior) = OPTIONAL];
}

// Defines what action to take for a specific severity match.
message SeverityOverride {
  // Required. Severity level to match.
  Severity severity = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Threat action override.
  ThreatAction action = 2 [(google.api.field_behavior) = REQUIRED];
}

// Defines what action to take for a specific threat_id match.
message ThreatOverride {
  // Required. Vendor-specific ID of a threat to override.
  string threat_id = 1 [(google.api.field_behavior) = REQUIRED];

  // Output only. Type of the threat (read only).
  ThreatType type = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Required. Threat action override. For some threat types, only a subset of
  // actions applies.
  ThreatAction action = 3 [(google.api.field_behavior) = REQUIRED];
}

// Defines what action to take for antivirus threats per protocol.
message AntivirusOverride {
  // Required. Protocol to match.
  Protocol protocol = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Threat action override. For some threat types, only a subset of
  // actions applies.
  ThreatAction action = 2 [(google.api.field_behavior) = REQUIRED];
}