// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.securitycenter.v1;

option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
option java_multiple_files = true;
option java_outer_classname = "AgentAnomalyProto";
option java_package = "com.google.cloud.securitycenter.v1";
option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
option ruby_package = "Google::Cloud::SecurityCenter::V1";

// Represents details about an anomaly detected in an AI agent's behavior.
message AgentAnomaly {
  // The overall confidence score indicating the likelihood that this session
  // contains a true anomaly. The score ranges from 0.0 to 1.0, where 1.0
  // signifies 100% confidence in the presence of an anomaly and 0.0 signifies
  // 0% confidence.
  double confidence_score = 1;

  // The list of references to specific detectors that identified anomalies
  // within this session.
  repeated DetectorReference detector_references = 2;

  // References to the OpenTelemetry invocations.
  repeated InvocationReference invocation_references = 3;
}

// Represents a reference to a specific anomaly detector.
message DetectorReference {
  // Severity levels for detectors.
  enum Severity {
    // Unspecified severity.
    SEVERITY_UNSPECIFIED = 0;

    // Critical severity.
    CRITICAL = 1;

    // High severity.
    HIGH = 2;

    // Medium severity.
    MEDIUM = 3;

    // Low severity.
    LOW = 4;
  }

  // The severity of the detector.
  Severity severity = 1;

  // The unique identifier of the detector.
  string detector_id = 2;

  // A human readable name for the detector, providing context on its purpose.
  // For example, "ASI02: Tool Misuse", or "Excessive API Calls".
  string display_name = 3;

  // A detailed explanation generated by an LLM or the detector itself,
  // describing why this specific anomaly was flagged. This provides rationale
  // and context for the detection.
  string explanation = 4;

  // Recommended steps or actions to remediate or investigate the anomaly
  // flagged by this detector. These could include configuration changes, code
  // adjustments, or further diagnostic procedures.
  string recommendation = 5;
}

// Represents a reference to a specific OpenTelemetry invocation.
message InvocationReference {
  // The unique identifier of the invocation.
  string invocation_id = 1;
}