Skip to content

Commit 81d7770

Browse files
dandyedandye
authored
Merge branch 'chronicle:master' into v1alpha_ingestion
2 parents 7917ce2 + efde6b5 commit 81d7770

File tree

11 files changed

+1149
-17
lines changed

11 files changed

+1149
-17
lines changed

‎common/regions.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,17 @@
2525
"asia-southeast1",
2626
"australia-southeast1",
2727
"eu",
28+
"europe",
29+
"europe-west12",
2830
"europe-west2",
2931
"europe-west3",
3032
"europe-west6",
33+
"europe-west9",
34+
"me-central1",
3135
"me-central2",
3236
"me-west1",
3337
"northamerica-northeast2",
38+
"southamerica-east1",
3439
"us",
3540
)
3641

‎detect/v1alpha/bulk_update_alerts.py‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
#!/usr/bin/env python3
2+
3+
# Copyright 2024 Google LLC
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
r"""Executable and reusable sample for bulk updating alerts.
18+
19+
The file provided to the --alert_ids_file parameter should have one alert
20+
ID per line like so:
21+
```
22+
de_ad9d2771-a567-49ee-6452-1b2db13c1d33
23+
de_3c2e2556-aba1-a253-7518-b4ddb666cc32
24+
```
25+
Usage:
26+
python -m alerts.v1alpha.bulk_update_alerts \
27+
--project_id=<PROJECT_ID> \
28+
--project_instance=<PROJECT_INSTANCE> \
29+
--alert_ids_file=<PATH_TO_FILE> \
30+
--confidence_score=<CONFIDENCE_SCORE> \
31+
--priority=<PRIORITY> \
32+
--reason=<REASON> \
33+
--reputation=<REPUTATION> \
34+
--priority=<PRIORITY> \
35+
--status=<STATUS> \
36+
--verdict=<VERDICT> \
37+
--risk_score=<RISK_SCORE> \
38+
--disregarded=<DISREGARDED> \
39+
--severity=<SEVERITY> \
40+
--comment=<COMMENT> \
41+
--root_cause=<ROOT_CAUSE> \
42+
--severity_display=<SEVERITY_DISPLAY>
43+
44+
# pylint: disable=line-too-long
45+
API reference:
46+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyUpdateAlert
47+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/Noun#Priority
48+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/Noun#Reason
49+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/Noun#Reputation
50+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/Noun#Priority
51+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/Noun#Status
52+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/Noun#Verdict
53+
"""
54+
# pylint: enable=line-too-long
55+
56+
import json
57+
58+
from common import chronicle_auth
59+
60+
from . import update_alert
61+
62+
63+
CHRONICLE_API_BASE_URL = "https://chronicle.googleapis.com"
64+
SCOPES = [
65+
"https://www.googleapis.com/auth/cloud-platform",
66+
]
67+
DEFAULT_FEEDBACK = {
68+
"comment": "automated cleanup",
69+
"reason": "REASON_MAINTENANCE",
70+
"reputation": "REPUTATION_UNSPECIFIED",
71+
"root_cause": "Other",
72+
"status": "CLOSED",
73+
"verdict": "VERDICT_UNSPECIFIED",
74+
}
75+
76+
77+
if __name__ == "__main__":
78+
parser = update_alert.get_update_parser()
79+
parser.add_argument(
80+
"--alert_ids_file", type=str, required=True,
81+
help="File with one alert ID per line."
82+
)
83+
parser.set_defaults(
84+
comment=DEFAULT_FEEDBACK["comment"],
85+
reason=DEFAULT_FEEDBACK["reason"],
86+
reputation=DEFAULT_FEEDBACK["reputation"],
87+
root_cause=DEFAULT_FEEDBACK["root_cause"],
88+
status=DEFAULT_FEEDBACK["status"],
89+
verdict=DEFAULT_FEEDBACK["verdict"],
90+
)
91+
args = parser.parse_args()
92+
93+
# raise error if required args are not present
94+
update_alert.check_args(parser, args)
95+
96+
auth_session = chronicle_auth.initialize_http_session(
97+
args.credentials_file,
98+
SCOPES,
99+
)
100+
with open(args.alert_ids_file) as fh:
101+
for alert_id in fh:
102+
a_list = update_alert.update_alert(
103+
auth_session,
104+
args.project_id,
105+
args.project_instance,
106+
args.region,
107+
alert_id.strip(),
108+
args.confidence_score,
109+
args.reason,
110+
args.reputation,
111+
args.priority,
112+
args.status,
113+
args.verdict,
114+
args.risk_score,
115+
args.disregarded,
116+
args.severity,
117+
args.comment,
118+
args.root_cause,
119+
)
120+
print(json.dumps(a_list, indent=2))

‎detect/v1alpha/get_alert.py‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
#!/usr/bin/env python3
2+
3+
# Copyright 2024 Google LLC
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
r"""Executable and reusable sample for getting a Reference List.
18+
19+
Usage:
20+
python -m alerts.v1alpha.get_alert \
21+
--project_id=<PROJECT_ID> \
22+
--project_instance=<PROJECT_INSTANCE> \
23+
--alert_id=<ALERT_ID>
24+
25+
API reference:
26+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetAlert
27+
28+
"""
29+
30+
import argparse
31+
import json
32+
from typing import Any, Mapping
33+
34+
from common import chronicle_auth
35+
from common import project_id
36+
from common import project_instance
37+
from common import regions
38+
39+
from google.auth.transport import requests
40+
41+
CHRONICLE_API_BASE_URL = "https://chronicle.googleapis.com"
42+
SCOPES = [
43+
"https://www.googleapis.com/auth/cloud-platform",
44+
]
45+
46+
47+
def get_alert(
48+
http_session: requests.AuthorizedSession,
49+
proj_id: str,
50+
proj_instance: str,
51+
proj_region: str,
52+
alert_id: str,
53+
include_detections: bool = False,
54+
) -> Mapping[str, Any]:
55+
"""Gets an Alert.
56+
57+
Args:
58+
http_session: Authorized session for HTTP requests.
59+
proj_id: GCP project id or number to which the target instance belongs.
60+
proj_instance: Customer ID (uuid with dashes) for the Chronicle instance.
61+
proj_region: region in which the target project is located.
62+
alert_id: Identifier for the alert.
63+
include_detections: Flag to include detections.
64+
65+
Returns:
66+
Dictionary representation of the Alert
67+
68+
Raises:
69+
requests.exceptions.HTTPError: HTTP request resulted in an error
70+
(response.status_code >= 400).
71+
"""
72+
base_url_with_region = regions.url_always_prepend_region(
73+
CHRONICLE_API_BASE_URL,
74+
proj_region
75+
)
76+
# pylint: disable-next=line-too-long
77+
parent = f"projects/{proj_id}/locations/{proj_region}/instances/{proj_instance}"
78+
79+
query_params = {"alertId": alert_id}
80+
if include_detections:
81+
query_params["includeDetections"] = True
82+
83+
url = f"{base_url_with_region}/v1alpha/{parent}/legacy:legacyGetAlert"
84+
85+
response = http_session.request("GET", url, params=query_params)
86+
# Expected server response is described in:
87+
# https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetAlert
88+
if response.status_code >= 400:
89+
print(response.text)
90+
response.raise_for_status()
91+
return response.json()
92+
93+
94+
if __name__ == "__main__":
95+
parser = argparse.ArgumentParser()
96+
chronicle_auth.add_argument_credentials_file(parser)
97+
project_instance.add_argument_project_instance(parser)
98+
project_id.add_argument_project_id(parser)
99+
regions.add_argument_region(parser)
100+
parser.add_argument(
101+
"--alert_id", type=str, required=True,
102+
help="identifier for the alert"
103+
)
104+
parser.add_argument(
105+
"-d", "--include-detections", type=bool, default=False, required=False,
106+
help="flag to include detections"
107+
)
108+
args = parser.parse_args()
109+
110+
auth_session = chronicle_auth.initialize_http_session(
111+
args.credentials_file,
112+
SCOPES,
113+
)
114+
alert = get_alert(
115+
auth_session,
116+
args.project_id,
117+
args.project_instance,
118+
args.region,
119+
args.alert_id,
120+
args.include_detections,
121+
)
122+
print(json.dumps(alert, indent=2))

0 commit comments

Comments
 (0)