chronicle / cbn-tool

Command line tool to interact with Chronicle's Config Based Normalizer (CBN) APIs.

Chronicle API Samples in Python

Python samples and guidelines for using Chronicle APIs.

Setup

Follow these instructions: https://cloud.google.com/python/setup

You may skip installing the Cloud Client Libraries and the Cloud SDK, they are unnecessary for interacting with Chronicle.

After creating and activating a virtual environment, install Python library dependencies by running this command:

pip install -r requirements.txt

It is assumed that you're using Python 3.7 or above. If you're using an older Python 3 version, you need to install this backported library as well:

pip install dataclasses

Credentials

Running the samples requires a JSON credentials file. By default, all the samples try to use the file .chronicle_credentials.json in the user's home directory. If this file is not found, you need to specify it explicitly by adding the following argument to the sample's command-line:

-c <file_path>

or

--credentials_file <file_path>

Usage

You can run samples on the command-line, assuming the current working directory is the root directory of this repository (i.e. the directory which contains this README.md file):

Detect API

python3 -m detect.v2.<sample_name> -h

Lists API

python3 -m lists.<sample_name> -h

Lists API v1alpha

python -m lists.v1alpha.create_list -h
python -m lists.v1alpha.get_list -h
python -m lists.v1alpha.patch_list -h

cbn-tool's Issues

Argparse not accepting --region or --credentials_file

Desired behaviour:

• adding --credentials_file should accept a path pointing to the ouath file for authentication
• adding --region=EUROPE should change the Chronicle region.

Current Behaviour
When run with

python3 cbn_cli.py gen --log_type=SONIC_FIREWALL --start_date=2022-01-31T00:00:00Z --end_date=2022-01-31T12:00:00Z --credentials_file=/Users/me/Documents/code/chronicle/keys/auth.json --region="EUROPE"

result in errors for both args

cbn_cli.py: error: unrecognized arguments: --credentials_file=/Users/me/Documents/code/chronicle/keys/auth.json --region=EUROPE

Workaround

• override DEFAULT_CREDS_FILE_PATH to a key fie on line 37
• specify the default region as your region for the args on line 428

Troubleshooting so far

• Wrapping all arg values in quotes
• Tried --arg=value and --arg value
• Purged the repo
• Purged the python virtual env and recreated
• Copied and pasted the args I want to use from --help to make sure I'm not fat fingering options

Env

• Python 3.9.2 (via HomeBrew)
• MacOS 11.6.2

Discussed with darrenswift who requested I make the issue here

includes

Hi there, the cbn tool does not seem to support includes. I think this is because the include is stored locally and not on the server so when running tests the includes are not followed. Is there a way we can pre parse the config and follow the include links to effectively build a temporary conf file with the includes all embedded? Otherwise I am only able to manually embed them which is fine for one or two but any more and things get unwieldy. Just an idea for an FR perhaps??.

Doc update

For the non US regions of Chronicle can we please ensure the readme or docs are up to date with appending the correct regional variable e.g 'europe-'

Despite specifying --credentials_file, cbn_cli still looks for credentials in .chronicle_credentials.json.

When I run the command:

$ python3 cbn_cli.py gen --credentials_file ~/bk_credentials.json --log_type=GCP_DNS --start_date=2021-01-01 --end_date=2021-04-29

I get the following error:

usage: cbn_cli.py [-h] [--region {US,EUROPE,ASIA}] [--credentials_file CREDENTIALS_FILE] {generate,g,gen,run,r,submit,status,list,history,archive,download,error,e,err} ...
cbn_cli.py: error: argument --credentials_file: /home/applmak/.chronicle_credentials.json does not exist

which is unexpected. Either the flag-parsing is wrong, or the script is ignore the argument.