chronicle/api-samples-python

Python samples and utilities for Chronicle APIs

Chronicle API Samples in Python

Python samples and guidelines for using Chronicle APIs.

Setup

Follow these instructions: https://cloud.google.com/python/setup

You may skip installing the Cloud Client Libraries and the Cloud SDK, they are unnecessary for interacting with Chronicle.

After creating and activating a virtual environment, install Python library dependencies by running this command:

pip install -r requirements.txt

It is assumed that you're using Python 3.7 or above. If you're using an older Python 3 version, you need to install this backported library as well:

pip install dataclasses

Credentials

Running the samples requires a JSON credentials file. By default, all the samples try to use the file .chronicle_credentials.json in the user's home directory. If this file is not found, you need to specify it explicitly by adding the following argument to the sample's command-line:

-c <file_path>

or

--credentials_file <file_path>

Usage

You can run samples on the command-line, assuming the current working directory is the root directory of this repository (i.e. the directory which contains this README.md file):

Detect API

python3 -m detect.v2.<sample_name> -h

Lists API

python3 -m lists.<sample_name> -h

Lists API v1alpha

python -m lists.v1alpha.create_list -h
python -m lists.v1alpha.get_list -h
python -m lists.v1alpha.patch_list -h

api-samples-python's Issues

update README.md

update from pip3 install google-api-client
to pip3 install google-api-python-client

wrong name for eu region

I believe you have the incorrect region name defined in common/regions.py for "eu". I think that is supposed to be "europe" (to get translated to utilizing https://europe-backstory.googleapis.com as the base URL)

Geographical instance support

For Europe tenants
CHRONICLE_API_BASE_URL = "https://backstory.googleapis.com"
needs to be replaced with
CHRONICLE_API_BASE_URL = "https://europe-backstory.googleapis.com"
Please can I make a suggestion that this is fully supported with he option of a region argument on the commandline?

For example
python3 -m detect.v2.list_rules -c ./credential.json -r europe

Where r is the region?

Test issue 1, ignore

Testing an internal team process. Ignore this, there is no AI, and I will eventually close this

Any plans on creating a Terraform provider?

Hi,

This is not related to this repo perse, but it is related to building interfaces for the Chronicle API - which this repo does with Python. Title says it all, are you planning on creating a Terraform provider for Chronicle? We've been developing one ourselves using https://github.com/Mastercard/terraform-provider-restapi - but ideally this would be something that is managed by Google.

search/ list structured query events 403

I've run into an issue when trying to access the structured query events api.
When called with valid credentials as follows:
python -m search.list_structured_query_events -c "pathtocreds" -ts 2022-05-01T00:00:00Z -te 2022-05-02T00:00:00Z -rq ".*"
It returns:
{ "error": { "code": 403, "message": "The caller does not have permission", "status": "PERMISSION_DENIED" } }
I also cannot find any documentation for it. Does it only support UDM? And can logtype/source be filtered for?