# GCP Security Risk API Server

This is a Google Cloud Platform (GCP) Cloud Function that serves as an API server for querying security risks from the GCP Security Command Center (SCC). It provides endpoints to retrieve various types of security findings including threats, toxic combinations, risk bulletins, and OS vulnerabilities.

## Features

- Query different types of security findings from GCP Security Command Center
- Filter findings by time range, severity, and finding type
- Pagination support for handling large result sets
- Token-based authentication for API access
- Support for multiple finding types:
  - THREAT findings
  - TOXIC_COMBINATION findings
  - RISK_BULLETIN findings (GKE Security Bulletins)
  - OS_VULNERABILITY findings

## Prerequisites

- Go 1.23.6 or higher
- Google Cloud Platform account with Security Command Center enabled
- Access to a GCP folder with security findings
- Proper IAM permissions for accessing Security Command Center

## Dependencies

- `cloud.google.com/go/securitycenter v1.33.1` - GCP Security Command Center client library
- Other indirect dependencies listed in [go.mod](go.mod)

## Installation

1. Clone the repository:
   ```bash
   git clone <repository-url>
   cd GCP_SecurityRisk_APIServer
   ```

2. Install dependencies:
   ```bash
   go mod tidy
   ```

3. Set up environment variables:
   ```bash
   export ACCESS_TOKEN="your-access-token"
   export GOOGLE_APPLICATION_CREDENTIALS="path/to/service-account-key.json"
   ```

## Configuration

The following constants are defined in the code and may need to be adjusted:

- `GCP_Folder_ID`: The GCP folder ID to query for security findings
- `AuthorizationToken`: Default authorization token (should be overridden by environment variable)

Environment variables:
- `ACCESS_TOKEN`: The expected authorization token for API access
- `GOOGLE_APPLICATION_CREDENTIALS`: Path to GCP service account credentials

## Usage

### Running locally

```bash
go run .
```

### Deploying to GCP Cloud Functions

```bash
gcloud functions deploy security-risk-api \
  --runtime go121 \
  --entry-point Mains \
  --trigger-http \
  --allow-unauthenticated=false \
  --set-env-vars ACCESS_TOKEN=your-access-token
```

### API Endpoints

All requests must include a valid `Authorization` header with the access token.

#### Headers

- `Authorization`: Required access token
- `Querytype`: Type of query to perform (threat, toxic, riskbulletin, osvul)
- `Time`: Time range for findings (supports formats like "6h", "1d", "7")
- `Servity`: Comma-separated list of severity levels (LOW, MEDIUM, HIGH, CRITICAL)
- `Page_size`: Number of results per page (default: 100, max: 1000)
- `Page_token`: Token for pagination
- `Filter`: Base64-encoded filter string for pagination requests

#### Query Types

1. `threat`: Query THREAT findings
2. `toxic`: Query TOXIC_COMBINATION findings
3. `riskbulletin`: Query RISK_BULLETIN findings (GKE Security Bulletins)
4. `osvul`: Query OS_VULNERABILITY findings

#### Example Requests

```bash
# Query critical threat findings from the last 24 hours
curl -H "Authorization: your-access-token" \
     -H "Querytype: threat" \
     -H "Time: 1d" \
     -H "Servity: CRITICAL" \
     https://your-region-your-project.cloudfunctions.net/security-risk-api

# Query toxic combination findings with pagination
curl -H "Authorization: your-access-token" \
     -H "Querytype: toxic" \
     -H "Time: 6h" \
     -H "Page_size: 50" \
     https://your-region-your-project.cloudfunctions.net/security-risk-api
```

## Response Format

Responses are returned in JSON format with the following structure:

```json
{
  "findings_count": 10,
  "next_page_token": "base64-encoded-token",
  "filter_used": "base64-encoded-filter",
  "findings": [...]
}
```

## Error Handling

The API returns appropriate HTTP status codes for different error conditions:
- 400 Bad Request: Missing or invalid headers
- 401 Unauthorized: Invalid or missing authorization token
- 500 Internal Server Error: Issues with the Security Command Center client

## Internal Use

This API is for internal use by the security team only and should not be made public. Ensure that only authorized personnel can access this system.

## Maintenance

1. Create a feature branch
2. Commit your changes
3. Push to the branch
4. Create a pull request