@@ -85,16 +85,18 @@ make dist
8585
8686## Using the Chronicle REST API SDK
8787
88- The SDK provides a unified command-line interface for Chronicle APIs. The CLI follows this pattern:
88+ The SDK provides a unified command-line interface for Chronicle APIs.
89+ The CLI follows this pattern:
8990```
9091chronicle [common options] COMMAND_GROUP COMMAND [command options]
9192```
9293
9394### Common Options
9495
95- Common options can be provided either via command-line arguments or environment variables:
96+ Common options can be provided either via command-line arguments or environment
97+ variables:
9698
97- | CLI Option | Environment Variable | Description |
99+ | CLI Option | Environment Variable | Description |
98100| --------------------| ----------------------------| --------------------------------|
99101| --credentials-file | CHRONICLE_CREDENTIALS_FILE | Path to service account file |
100102| --project-id | CHRONICLE_PROJECT_ID | GCP project id or number |
@@ -112,7 +114,8 @@ CHRONICLE_REGION=your-region
112114```
113115
114116The SDK will use values from the ` .env ` file provided with the --env-file flag.
115- (It has trouble finding your local .env due to SDK Path issues, which we are working to resolve.)
117+ (It has trouble finding your local .env due to SDK Path issues, which we are
118+ working to resolve.)
116119 Command-line options take precedence over environment variables.
117120
118121### Command Groups
@@ -123,6 +126,7 @@ chronicle detect <command-group> <command> [options]
123126```
124127
125128Available command groups:
129+
126130- ` alerts `
127131 - ` get <alert-id> ` : Get alert by ID
128132 - ` update <alert-id> ` : Update an alert
@@ -155,6 +159,7 @@ chronicle ingestion <command> [options]
155159```
156160
157161Available commands:
162+
158163- ` import-events ` : Import events into Chronicle
159164- ` get-event <event-id> ` : Get event details
160165- ` batch-get-events ` : Batch retrieve events
@@ -165,6 +170,7 @@ chronicle search <command> [options]
165170```
166171
167172Available commands:
173+
168174- ` find-asset-events [--filter <filter>] ` : Find events for an asset
169175- ` find-raw-logs [--filter <filter>] ` : Search raw logs
170176- ` find-udm-events [--filter <filter>] ` : Find UDM events
@@ -175,9 +181,11 @@ chronicle lists <command> [options]
175181```
176182
177183Available commands:
184+
178185- ` create <name> [--description <desc>] --lines <json-array> ` : Create a new list
179186- ` get <list-id> ` : Get list by ID
180- - ` patch <list-id> [--description <desc>] [--lines-to-add <json-array>] [--lines-to-remove <json-array>] ` : Update an existing list
187+ - ``` patch <list-id> [--description <desc>] [--lines-to-add <json-array>] \
188+ [--lines-to-remove <json-array>]```: Update an existing list
181189
182190# ## Examples
183191
@@ -187,18 +195,23 @@ Using environment variables (after setting up .env):
187195chronicle detect alerts get --alert-id ABC123 --env-file=.env
188196
189197# Create a list
190- chronicle lists create --name " blocklist" --description " Blocked IPs" --lines ' ["1.1.1.1", "2.2.2.2"]' --env-file=.env
198+ chronicle lists create --name "blocklist" --description "Blocked IPs" \
199+ --lines '["1.1.1.1", "2.2.2.2"]' \
200+ --env-file=.env
191201
192202# Search for events
193- chronicle search find-raw-logs --filter " timestamp.seconds > 1600000000" --env-file=.env
203+ chronicle search find-raw-logs --filter "timestamp.seconds > 1600000000" \
204+ --env-file=.env
194205
195206# Override a specific environment variable
196- chronicle --region us-central1 detect alerts get --alert-id ABC123 --env-file=.env
207+ chronicle --region us-central1 detect alerts get --alert-id ABC123 \
208+ --env-file=.env
197209```
198210
199211## Running Individual Scripts
200212
201- You can also run individual API sample scripts directly. Each script supports the ` -h ` flag to show available options:
213+ You can also run individual API sample scripts directly.
214+ Each script supports the ` -h ` flag to show available options:
202215
203216``` bash
204217# Get help for a specific script
0 commit comments