chronicle / cli

A CLI tool for managing Chronicle user workflows

Chronicle API Samples in Python

Python samples and guidelines for using Chronicle APIs.

Setup

Follow these instructions: https://cloud.google.com/python/setup

You may skip installing the Cloud Client Libraries and the Cloud SDK, they are unnecessary for interacting with Chronicle.

After creating and activating a virtual environment, install Python library dependencies by running this command:

pip install -r requirements.txt

It is assumed that you're using Python 3.7 or above. If you're using an older Python 3 version, you need to install this backported library as well:

pip install dataclasses

Credentials

Running the samples requires a JSON credentials file. By default, all the samples try to use the file .chronicle_credentials.json in the user's home directory. If this file is not found, you need to specify it explicitly by adding the following argument to the sample's command-line:

-c <file_path>

or

--credentials_file <file_path>

Usage

You can run samples on the command-line, assuming the current working directory is the root directory of this repository (i.e. the directory which contains this README.md file):

Detect API

python3 -m detect.v2.<sample_name> -h

Lists API

python3 -m lists.<sample_name> -h

Lists API v1alpha

python -m lists.v1alpha.create_list -h
python -m lists.v1alpha.get_list -h
python -m lists.v1alpha.patch_list -h

cli's Issues

Any plan to add suppport for customer management API which exists in another legacy script?

https://cloud.google.com/chronicle/docs/preview/customer-management-api/customer-management-api

Required for MSSP partner to create the instances and manage the instances.

Friction while transitioning from CBN to chronicle_cli

Hello

Since transitioning from cbn_cli to chronicle_cli, I've been missing an easy method to pass CLI arguments to the script. Retyping datetimes and filepaths when generating sample logs or testing parser changes has been slowing down my workflow.

To address this, i've been porting across the required arguments as I encounter friction. However, i'm happy to perform a more comprehensive update and submit a PR if there would be interest in incorporating these changes into the main project.

readme say to use .chronicle_credentials.json

The file name should be chronicle_credentials.json without .

~/.chronicle_cli$ chronicle_cli feeds list
Failed with exception: [Errno 2] No such file or directory: ****/.chronicle_cli/chronicle_credentials.json'

Typo with parsers response

When interacting with the CLI without a credential package populated you get the following response that has Project with a typo (Porject).

chronicle_cli parsers list_parsers --v2

Project ID not provided. Please enter Porject ID

--v2 does not have a download flag

When using the --v2 flags, there is no download option. Having the ability to Push, Delete, Activate, and Disable parsers through automation is risky without validating what's in the parser first. This can be done in non v2, but this is not compatible with v2 calls as v2 uses 'Parser ID' and non v2 uses 'Config ID'.

Can you add the download capability into the v2 flags for parsers and extensions?