feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/notifications/__init__.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Cloud SCC (Security Command Center) Notifications."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+class NotificationConfigs(base.Group):
+  """Manage Cloud SCC (Security Command Center) notifications."""
+
+  category = base.SECURITY_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/notifications/create.py

@@ -0,0 +1,171 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Command for creating a Cloud Security Command Center NotificationConfig."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.scc import securitycenter_client
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.scc import flags as scc_flags
+from googlecloudsdk.command_lib.scc import util as scc_util
+from googlecloudsdk.command_lib.scc.notifications import flags as notifications_flags
+from googlecloudsdk.command_lib.scc.notifications import notification_util
+from googlecloudsdk.core import log
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA
+)
+@base.DefaultUniverseOnly
+class Create(base.CreateCommand):
+  """Create a Security Command Center notification config."""
+
+  detailed_help = {
+      'DESCRIPTION': """\
+      Create a Security Command Center notification config.
+
+      Notification configs that are created with Security Command Center API V2
+      and later include a `location` attribute. If a location is not specified,
+      the default `global` location is used. For example, the following
+      Notification config name has `location=global` attribute:
+      `organizations/123/locations/global/notificationConfigs/my-config`.""",
+      'EXAMPLES': """\
+      Create a notification config test-config under organization 123 for
+      findings for pubsub-topic projects/test-project/topics/notification-test
+      with a filter on resource name:
+
+        $ {command} test-config --organization=123
+          --pubsub-topic=projects/test-project/topics/notification-test
+          --filter="resource_name: \\"a\\""
+
+      Create a notification config `test-config` under folder `456` for findings
+      for pubsub-topic `projects/test-project/topics/notification-test` with a
+      filter on resource name:
+
+        $ {command} test-config --folder=456
+          --pubsub-topic=projects/test-project/topics/notification-test
+          --filter="resource_name: \\"a\\""
+
+      Create a notification config `test-config` under project `789` for
+      findings for pubsub-topic `projects/test-project/topics/notification-test`
+      with a filter on resource name:
+
+        $ {command} test-config --project=789
+          --pubsub-topic=projects/test-project/topics/notification-test
+          --filter="resource_name: \\"a\\""
+
+      Create a notification config `test-config` under organization `123` for
+      findings for `pubsub-topic projects/test-project/topics/notification-test`
+      with a filter on resource name and `location=eu`
+
+        $ {command} test-config --project=789
+          --pubsub-topic=projects/test-project/topics/notification-test
+          --filter="resource_name: \\"a\\"" --location=eu
+      """,
+      'API REFERENCE': """\
+      This command uses the Security Command Center API. For more information,
+      see [Security Command Center API.](https://cloud.google.com/security-command-center/docs/reference/rest)
+      """,
+  }
+
+  @staticmethod
+  def Args(parser):
+
+    notifications_flags.PUBSUB_TOPIC_REQUIRED_FLAG.AddToParser(parser)
+    notifications_flags.DESCRIPTION_FLAG.AddToParser(parser)
+    notifications_flags.FILTER_FLAG.AddToParser(parser)
+
+    notifications_flags.AddNotificationConfigPositionalArgument(parser)
+    notifications_flags.AddParentGroup(parser)
+
+    scc_flags.API_VERSION_FLAG.AddToParser(parser)
+    notifications_flags.CREATE_NOTIFICATION_CONFIG_LOCATION_FLAG.AddToParser(
+        parser
+    )
+
+  def Run(self, args):
+    parent = scc_util.GetParentFromNamedArguments(args)
+    notification_util.ValidateMutexOnConfigIdAndParent(args, parent)
+
+    # Determine what version to call from --location and --api-version.
+    version = scc_util.GetVersionFromArguments(
+        args, args.NOTIFICATIONCONFIGID, version_specific_existing_resource=True
+    )
+    messages = securitycenter_client.GetMessages(version)
+    client = securitycenter_client.GetClient(version)
+
+    # Build initial request from versioned messages
+    if version == 'v1':
+      req = (
+          messages.SecuritycenterOrganizationsNotificationConfigsCreateRequest()
+      )
+      config_name = notification_util.ValidateAndGetNotificationConfigV1Name(
+          args
+      )
+    else:
+      req = (
+          messages.SecuritycenterOrganizationsLocationsNotificationConfigsCreateRequest()
+      )
+      config_name = notification_util.ValidateAndGetNotificationConfigV2Name(
+          args
+      )
+
+    req.parent = notification_util.GetParentFromNotificationConfigName(
+        config_name
+    )
+    req.configId = _GetNotificationConfigId(config_name)
+
+    req.notificationConfig = messages.NotificationConfig()
+    req.notificationConfig.description = args.description
+    req.notificationConfig.pubsubTopic = args.pubsub_topic
+
+    # Use the full config name if provided.
+    if '/notificationConfigs/' in args.NOTIFICATIONCONFIGID:
+      req.notificationConfig.name = config_name
+    else:
+      req.notificationConfig.name = args.NOTIFICATIONCONFIGID
+
+    # Set the Streaming Config inside Notification Config.
+    streaming_config = messages.StreamingConfig()
+    if args.filter is None:
+      streaming_config.filter = ''
+    else:
+      streaming_config.filter = args.filter
+    req.notificationConfig.streamingConfig = streaming_config
+
+    # SCC's custom --filter is passing the streaming config filter as part of
+    # the request body. However --filter is a global filter flag in gcloud. The
+    # --filter flag in gcloud (outside of this command) is used as client side
+    # filtering. This has led to a collision in logic as gcloud believes the
+    # update is trying to perform client side filtering. Since changing the
+    # argument flag would be considered a breaking change, setting args.filter
+    # to None in the request hook will skip over the client side filter logic.
+    args.filter = None
+
+    if version == 'v1':
+      result = client.organizations_notificationConfigs.Create(req)
+    else:
+      result = client.organizations_locations_notificationConfigs.Create(req)
+    log.status.Print('Created.')
+    return result.name
+
+
+def _GetNotificationConfigId(resource_name):
+  params_as_list = resource_name.split('/')
+  return params_as_list[-1]

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/notifications/delete.py

@@ -0,0 +1,124 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command for deleting a Cloud Security Command Center notification config."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.scc import securitycenter_client
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.scc import flags as scc_flags
+from googlecloudsdk.command_lib.scc import util as scc_util
+from googlecloudsdk.command_lib.scc.notifications import flags as notifications_flags
+from googlecloudsdk.command_lib.scc.notifications import notification_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core.console import console_io
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA
+)
+@base.DefaultUniverseOnly
+class Delete(base.DeleteCommand):
+  """Delete a Security Command Center notification config."""
+
+  detailed_help = {
+      'DESCRIPTION': """\
+      Delete a Security Command Center notification config.
+
+      Notification configs that are created with Security Command Center API V2
+      and later include a `location` attribute. If the `location` attribute is
+      included in the resource name of a Notification configs, you must specify
+      it when referencing the Notification config. For example, the following
+      Notification configs name has `location=eu`:
+      `organizations/123/locations/eu/notificationConfigs/test-config`.
+      """,
+      'EXAMPLES': """\
+      Delete notification config 'test-config' from organization `123`
+
+        $ {command} test-config --organization=123
+
+      Delete notification config 'test-config' from folder `456`
+
+        $ {command} test-config --folder=456
+
+      Delete notification config 'test-config' from project `789`
+
+        $ {command} test-config --project=789
+
+      Delete notification config 'test-config' with location `global` from
+      organization `123`
+
+        $ {command} test-config --organization=123 --location=global
+
+      Delete notification config 'test-config' with `location=eu` from
+      organization `123`
+
+        $ {command} test-config --organization=123 --location=eu
+      """,
+      'API REFERENCE': """\
+      This command uses the Security Command Center API. For more information,
+      see [Security Command Center API.](https://cloud.google.com/security-command-center/docs/reference/rest)
+      """,
+  }
+
+  @staticmethod
+  def Args(parser):
+
+    notifications_flags.AddParentGroup(parser)
+    notifications_flags.AddNotificationConfigPositionalArgument(parser)
+
+    scc_flags.API_VERSION_FLAG.AddToParser(parser)
+    notifications_flags.DELETE_NOTIFICATION_CONFIG_LOCATION_FLAG.AddToParser(
+        parser
+    )
+
+  def Run(self, args):
+
+    # Prompt user to confirm deletion.
+    console_io.PromptContinue(
+        message='Are you sure you want to delete a notification config?\n',
+        cancel_on_no=True,
+    )
+
+    # Validate mutex after prompt.
+    parent = scc_util.GetParentFromNamedArguments(args)
+    notification_util.ValidateMutexOnConfigIdAndParent(args, parent)
+
+    # Determine what version to call from --location and --api-version. The
+    # NotificationConfig is a version_specific_existing_resource that may not be
+    # accesed through v2 if it currently exists in v1, and vice vesra.
+    version = scc_util.GetVersionFromArguments(
+        args, args.NOTIFICATIONCONFIGID, version_specific_existing_resource=True
+    )
+    messages = securitycenter_client.GetMessages(version)
+    client = securitycenter_client.GetClient(version)
+
+    if version == 'v1':
+      req = (
+          messages.SecuritycenterOrganizationsNotificationConfigsDeleteRequest()
+      )
+      req.name = notification_util.ValidateAndGetNotificationConfigV1Name(args)
+      result = client.organizations_notificationConfigs.Delete(req)
+    else:
+      req = (
+          messages.SecuritycenterOrganizationsLocationsNotificationConfigsDeleteRequest()
+      )
+      req.name = notification_util.ValidateAndGetNotificationConfigV2Name(args)
+      result = client.organizations_locations_notificationConfigs.Delete(req)
+    log.status.Print('Deleted.')
+    return result

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/notifications/describe.py

@@ -0,0 +1,139 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command for describing a Cloud Security Command Center NotificationConfig."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.scc import securitycenter_client
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.scc import flags as scc_flags
+from googlecloudsdk.command_lib.scc import util as scc_util
+from googlecloudsdk.command_lib.scc.notifications import flags as notifications_flags
+from googlecloudsdk.command_lib.scc.notifications import notification_util
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA
+)
+@base.DefaultUniverseOnly
+class Describe(base.DescribeCommand):
+  """Describe a Security Command Center notification config."""
+
+  detailed_help = {
+      'DESCRIPTION': """\
+      Describe a Security Command Center notification config.
+
+      Notification configs that are created with Security Command Center API V2
+      and later include a `location` attribute. If the `location` attribute is
+      included in the resource name of a Notification configs, you must specify
+      it when referencing the Notification config. For example, the following
+      Notification configs name has `location=eu`:
+      `organizations/123/locations/eu/notificationConfigs/test-config`.
+      """,
+      'EXAMPLES': """\
+      Describe notification config 'test-config' from organization `123`
+
+          $ {command} test-config \
+              --organization=123
+
+      Describe notification config 'test-config' from folder `456`
+
+          $ {command} test-config \
+              --folder=456
+
+      Describe notification config 'test-config' from project `789`
+
+          $ {command} test-config \
+              --project=789
+
+      Describe notification config 'test-config' from organization `123` and
+      `location=global`
+
+          $ {command} test-config \
+              --organization=123 --location=global
+      """,
+      'API REFERENCE': """\
+      This command uses the Security Command Center API. For more information,
+      see [Security Command Center API.](https://cloud.google.com/security-command-center/docs/reference/rest)
+      """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    # Notification Config Id is a required argument.
+    parser.add_argument(
+        'NOTIFICATIONCONFIGID',
+        metavar='NOTIFICATION_CONFIG_ID',
+        help="""\
+         The ID of the notification config. Formatted as
+         "organizations/123/notificationConfigs/456" or just "456".
+        """,
+    )
+
+    # Set org/folder/project as mutually exclusive group.
+    resource_group = parser.add_group(required=False, mutex=True)
+    resource_group.add_argument(
+        '--organization',
+        help="""\
+            Organization where the notification config resides. Formatted as
+            ``organizations/123'' or just ``123''.
+            """,
+    )
+    resource_group.add_argument(
+        '--folder',
+        help="""\
+            Folder where the notification config resides. Formatted as
+            ``folders/456'' or just ``456''.
+        """,
+    )
+    resource_group.add_argument(
+        '--project',
+        help="""\
+            Project (ID or number) where the notification config resides.
+            Formatted as ``projects/789'' or just ``789''.
+        """,
+    )
+    scc_flags.API_VERSION_FLAG.AddToParser(parser)
+    notifications_flags.DESCRIBE_NOTIFICATION_CONFIG_LOCATION_FLAG.AddToParser(
+        parser
+    )
+
+  def Run(self, args):
+
+    parent = scc_util.GetParentFromNamedArguments(args)
+    notification_util.ValidateMutexOnConfigIdAndParent(args, parent)
+
+    # Determine what version to call from --location and --api-version. The
+    # NotificationConfig is a version_specific_existing_resource that may not be
+    # accesed through v2 if it currently exists in v1, and vice vesra.
+    version = scc_util.GetVersionFromArguments(
+        args, args.NOTIFICATIONCONFIGID, version_specific_existing_resource=True
+    )
+    messages = securitycenter_client.GetMessages(version)
+    client = securitycenter_client.GetClient(version)
+
+    if version == 'v1':
+      req = messages.SecuritycenterOrganizationsNotificationConfigsGetRequest()
+      req.name = notification_util.ValidateAndGetNotificationConfigV1Name(args)
+      return client.organizations_notificationConfigs.Get(req)
+    else:
+      req = (
+          messages.SecuritycenterOrganizationsLocationsNotificationConfigsGetRequest()
+      )
+      req.name = notification_util.ValidateAndGetNotificationConfigV2Name(args)
+      return client.organizations_locations_notificationConfigs.Get(req)

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/notifications/list.py

@@ -0,0 +1,113 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command for listing Cloud Security Command Center Notification Configs."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+from __future__ import unicode_literals
+
+from apitools.base.py import list_pager
+from googlecloudsdk.api_lib.scc import securitycenter_client
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.scc import flags as scc_flags
+from googlecloudsdk.command_lib.scc import util as scc_util
+from googlecloudsdk.command_lib.scc.notifications import flags as notifications_flags
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA
+)
+@base.DefaultUniverseOnly
+class List(base.ListCommand):
+  """List Security Command Center notification configs."""
+
+  detailed_help = {
+      'DESCRIPTION': """List Security Command Center notification configs.
+
+      Notification Configs that are created with Security Command Center API V2
+      and later include a `location` attribute. Include the `--location` flag to
+      list Notification Configs with `location` attribute other than `global`.
+      """,
+      'EXAMPLES': """\
+      List notification configs from organization `123`
+
+        $ {command} 123
+        $ {command} organizations/123
+
+      List notification configs from folder `456`
+
+        $ {command} folders/456
+
+      List notification configs from project `789`
+
+        $ {command} projects/789
+
+      List notification configs from organization `123` and `location=eu`
+
+        $ {command} 123 --location=eu
+        $ {command} organizations/123 --location=locations/eu
+      """,
+      'API REFERENCE': """\
+      This command uses the Security Command Center API. For more information,
+      see [Security Command Center API.](https://cloud.google.com/security-command-center/docs/reference/rest)
+      """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    # Remove URI flag.
+    base.URI_FLAG.RemoveFromParser(parser)
+
+    # Add shared flags and parent positional argument.
+    scc_flags.AppendParentArg()[0].AddToParser(parser)
+    notifications_flags.AddParentGroup(parser)
+    scc_flags.API_VERSION_FLAG.AddToParser(parser)
+    notifications_flags.LIST_NOTIFICATION_CONFIG_LOCATION_FLAG.AddToParser(
+        parser
+    )
+
+  def Run(self, args):
+    # Determine what version to call from --api-version.
+    version = scc_util.GetVersionFromArguments(
+        args, version_specific_existing_resource=True
+    )
+    messages = securitycenter_client.GetMessages(version)
+    client = securitycenter_client.GetClient(version)
+
+    if version == 'v1':
+      request = (
+          messages.SecuritycenterOrganizationsNotificationConfigsListRequest()
+      )
+      request.parent = scc_util.GetParentFromPositionalArguments(args)
+      endpoint = client.organizations_notificationConfigs
+    else:
+      request = (
+          messages.SecuritycenterOrganizationsLocationsNotificationConfigsListRequest()
+      )
+      location = scc_util.ValidateAndGetLocation(args, 'v2')
+      request.parent = f'{scc_util.GetParentFromPositionalArguments(args)}/locations/{location}'
+      endpoint = client.organizations_locations_notificationConfigs
+    request.pageSize = args.page_size
+
+    # Automatically handle pagination. All notifications are returned regardless
+    # of --page-size argument.
+    return list_pager.YieldFromList(
+        endpoint,
+        request,
+        batch_size_attribute='pageSize',
+        batch_size=args.page_size,
+        field='notificationConfigs',
+    )

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/notifications/update.py

@@ -0,0 +1,164 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command for updating a Cloud Security Command Center NotificationConfig."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.scc import securitycenter_client
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.scc import flags as scc_flags
+from googlecloudsdk.command_lib.scc import util as scc_util
+from googlecloudsdk.command_lib.scc.notifications import flags as notifications_flags
+from googlecloudsdk.command_lib.scc.notifications import notification_util
+from googlecloudsdk.core import log
+from googlecloudsdk.core import properties
+
+
+@base.ReleaseTracks(
+    base.ReleaseTrack.GA, base.ReleaseTrack.BETA, base.ReleaseTrack.ALPHA
+)
+@base.DefaultUniverseOnly
+class Update(base.UpdateCommand):
+  """Update a Security Command Center notification config."""
+
+  detailed_help = {
+      'DESCRIPTION': """\
+      Update a Security Command Center notification config.
+
+      Notification configs that are created with Security Command Center API V2
+      and later include a `location` attribute. If the `location` attribute is
+      included in the resource name of a Notification configs, you must specify
+      it when referencing the Notification config. For example, the following
+      Notification configs name has `location=eu`:
+      `organizations/123/locations/eu/notificationConfigs/test-config`.
+      """,
+      'EXAMPLES': """\
+      Update all mutable fields under an organization parent `test-config`
+      (description + pubsub topic + filter):
+
+        $ {command} scc notifications update test-config --organization=123 \
+            --description="New description" \
+            --pubsub-topic="projects/22222/topics/newtopic"
+
+      Update all mutable fields under a folder parent `test-config`
+      (description + pubsub topic + filter):
+
+        $ {command} scc notifications update test-config --folder=456 \
+            --description="New description" \
+            --pubsub-topic="projects/22222/topics/newtopic"
+
+      Update all mutable fields under a project parent `test-config`
+      (description + pubsub topic + filter):
+
+        $ {command} scc notifications update test-config --project=789 \
+            --description="New description" \
+            --pubsub-topic="projects/22222/topics/newtopic"
+
+      Update test-config's description
+
+        $ {command} test-config --organization=123 --description="New description"
+
+      Update test-config's pubsub-topic
+
+        $ {command} test-config --organization=123
+        --pubsub-topic="projects/22222/topics/newtopic"
+
+      Update test-config's filter
+
+        $ {command} test-config --organization=123 --filter='state = \\"ACTIVE\\"'
+
+      Update all mutable fields for `test-config` with `location=global` under an
+      organization parent (description + pubsub topic + filter):
+
+        $ {command} scc notifications update test-config --organization=123 \
+            --description="New description" \
+            --pubsub-topic="projects/22222/topics/newtopic" --location=global
+      """,
+      'API REFERENCE': """\
+      This command uses the Security Command Center API. For more information,
+      see [Security Command Center API.](https://cloud.google.com/security-command-center/docs/reference/rest)
+      """,
+  }
+
+  @staticmethod
+  def Args(parser):
+
+    notifications_flags.DESCRIPTION_FLAG.AddToParser(parser)
+    notifications_flags.FILTER_FLAG_LONG_DESCRIPTION.AddToParser(parser)
+    notifications_flags.PUBSUB_TOPIC_OPTIONAL_FLAG.AddToParser(parser)
+
+    notifications_flags.AddNotificationConfigPositionalArgument(parser)
+    notifications_flags.AddParentGroup(parser)
+
+    scc_flags.API_VERSION_FLAG.AddToParser(parser)
+    notifications_flags.UPDATE_NOTIFICATION_CONFIG_LOCATION_FLAG.AddToParser(
+        parser
+    )
+
+    parser.display_info.AddFormat(properties.VALUES.core.default_format.Get())
+
+  def Run(self, args):
+    # Determine what version to call from --location and --api-version. The
+    # NotificationConfig is a version_specific_existing_resource that may not be
+    # accesed through v2 if it currently exists in v1, and vice vesra.
+    version = scc_util.GetVersionFromArguments(
+        args, args.NOTIFICATIONCONFIGID, version_specific_existing_resource=True
+    )
+    messages = securitycenter_client.GetMessages(version)
+    client = securitycenter_client.GetClient(version)
+
+    parent = scc_util.GetParentFromNamedArguments(args)
+    notification_util.ValidateMutexOnConfigIdAndParent(args, parent)
+
+    if version == 'v1':
+      req = (
+          messages.SecuritycenterOrganizationsNotificationConfigsPatchRequest()
+      )
+      req.name = notification_util.ValidateAndGetNotificationConfigV1Name(args)
+      endpoint = client.organizations_notificationConfigs
+
+    else:
+      req = (
+          messages.SecuritycenterOrganizationsLocationsNotificationConfigsPatchRequest()
+      )
+      req.name = notification_util.ValidateAndGetNotificationConfigV2Name(args)
+      endpoint = client.organizations_locations_notificationConfigs
+
+    computed_update_mask = []
+    req.notificationConfig = messages.NotificationConfig()
+    if args.IsKnownAndSpecified('description'):
+      computed_update_mask.append('description')
+      req.notificationConfig.description = args.description
+    if args.IsKnownAndSpecified('pubsub_topic'):
+      computed_update_mask.append('pubsubTopic')
+      req.notificationConfig.pubsubTopic = args.pubsub_topic
+    if args.IsKnownAndSpecified('filter'):
+      computed_update_mask.append('streamingConfig.filter')
+      streaming_config = messages.StreamingConfig()
+      streaming_config.filter = args.filter
+      req.notificationConfig.streamingConfig = streaming_config
+
+    # User may not supply an updateMask.
+    req.updateMask = ','.join(computed_update_mask)
+
+    # Set the args' filter to None to avoid downstream naming conflicts.
+    args.filter = None
+
+    result = endpoint.Patch(req)
+    log.status.Print('Updated.')
+    return result