Skip to content

Commit 0fbad34

Browse files
jason-wgcopybara-github
jason-wg
authored and
copybara-github
committed
Add additional v1alpha samples for detection engine APIs
PiperOrigin-RevId: 605452860
1 parent 475fe55 commit 0fbad34

File tree

8 files changed

+959
-7
lines changed

8 files changed

+959
-7
lines changed

‎detect/v1alpha/create_retrohunt.py‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
#!/usr/bin/env python3
2+
3+
# Copyright 2024 Google LLC
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
r"""Executable sample for creating a retrohunt.
18+
19+
Sample Commands (run from api_samples_python dir):
20+
python3 -m detect.v1alpha.create_retrohunt \
21+
-r=<region> -p=<project_id> -i=<instance_id> -rid=<rule_id> \
22+
-st="2023-10-02T18:00:00Z" -et="2023-10-02T20:00:00Z"
23+
24+
API reference:
25+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules.retrohunts/create
26+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.operations#Operation
27+
"""
28+
import argparse
29+
import datetime
30+
import json
31+
from typing import Any, Mapping
32+
from common import chronicle_auth
33+
from common import datetime_converter
34+
from common import project_id
35+
from common import project_instance
36+
from common import regions
37+
from google.auth.transport import requests
38+
39+
CHRONICLE_API_BASE_URL = "https://chronicle.googleapis.com"
40+
41+
SCOPES = [
42+
"https://www.googleapis.com/auth/cloud-platform",
43+
]
44+
45+
46+
def create_retrohunt(
47+
http_session: requests.AuthorizedSession,
48+
proj_region: str,
49+
proj_id: str,
50+
proj_instance: str,
51+
rule_id: str,
52+
start_time: datetime.datetime,
53+
end_time: datetime.datetime,
54+
) -> Mapping[str, Any]:
55+
"""Creates a retrohunt.
56+
57+
Args:
58+
http_session: Authorized session for HTTP requests.
59+
proj_region: region in which the target project is located
60+
proj_id: GCP project id or number which the target instance belongs to
61+
proj_instance: uuid of the instance (with dashes)
62+
rule_id: Unique ID of the detection rule to retrieve ("ru_<UUID>").
63+
start_time: the start time of the event time range this retrohunt will be
64+
executed over
65+
end_time: the end time of the event time range this retrohunt will be
66+
executed over
67+
68+
Returns:
69+
an Operation resource object containing relevant retrohunt's information
70+
71+
Raises:
72+
requests.exceptions.HTTPError: HTTP request resulted in an error
73+
(response.status_code >= 400).
74+
"""
75+
base_url_with_region = regions.url_always_prepend_region(
76+
CHRONICLE_API_BASE_URL,
77+
args.region
78+
)
79+
# pylint: disable-next=line-too-long
80+
parent = f"projects/{proj_id}/locations/{proj_region}/instances/{proj_instance}"
81+
url = f"{base_url_with_region}/v1alpha/{parent}/rules/{rule_id}/retrohunts"
82+
body = {
83+
"process_interval": {
84+
"start_time": datetime_converter.strftime(start_time),
85+
"end_time": datetime_converter.strftime(end_time),
86+
},
87+
}
88+
89+
# See API reference links at top of this file, for response format.
90+
response = http_session.request("POST", url, json=body)
91+
if response.status_code >= 400:
92+
print(response.text)
93+
response.raise_for_status()
94+
return response.json()
95+
96+
97+
if __name__ == "__main__":
98+
parser = argparse.ArgumentParser()
99+
chronicle_auth.add_argument_credentials_file(parser)
100+
regions.add_argument_region(parser)
101+
project_instance.add_argument_project_instance(parser)
102+
project_id.add_argument_project_id(parser)
103+
parser.add_argument(
104+
"-rid",
105+
"--rule_id",
106+
type=str,
107+
required=True,
108+
help='rule ID to create retrohunt for. In the form of "ru_<UUID>"',
109+
)
110+
parser.add_argument(
111+
"-st",
112+
"--start_time",
113+
type=datetime_converter.iso8601_datetime_utc,
114+
required=True,
115+
help="Retrohunt start time in UTC ('yyyy-mm-ddThh:mm:ssZ')",
116+
)
117+
parser.add_argument(
118+
"-et",
119+
"--end_time",
120+
type=datetime_converter.iso8601_datetime_utc,
121+
required=True,
122+
help="Retrohunt end time in UTC ('yyyy-mm-ddThh:mm:ssZ')",
123+
)
124+
args = parser.parse_args()
125+
auth_session = chronicle_auth.initialize_http_session(
126+
args.credentials_file,
127+
SCOPES
128+
)
129+
print(
130+
json.dumps(
131+
create_retrohunt(
132+
auth_session,
133+
args.region,
134+
args.project_id,
135+
args.project_instance,
136+
args.rule_id,
137+
args.start_time,
138+
args.end_time,
139+
),
140+
indent=2,
141+
)
142+
)

‎detect/v1alpha/create_rule.py‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,19 @@
1717
r"""Executable and reusable sample for creating a detection rule.
1818
1919
Sample Commands (run from api_samples_python dir):
20-
python3 -m detect.v1alpha.create_rule \
21-
--region $region \
22-
--project_instance $project_instance \
23-
--project_id $PROJECT_ID \
24-
--rule_file=./path/to/rule/rulename.yaral
20+
# From file
21+
python3 -m detect.v1alpha.create_rule \
22+
--region $region \
23+
--project_instance $project_instance \
24+
--project_id $PROJECT_ID \
25+
--rule_file=./path/to/rule/rulename.yaral
26+
27+
# From stdin
28+
cat ./path/rulename.yaral | python3 -m detect.v1alpha.create_rule \
29+
--region $region \
30+
--project_instance $project_instance \
31+
--project_id $PROJECT_ID \
32+
--rule_file -
2533
2634
API reference:
2735
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules/create
@@ -101,8 +109,6 @@ def create_rule(
101109
"--rule_file",
102110
type=argparse.FileType("r"),
103111
required=True,
104-
# File example: python3 create_rule.py -f <path>
105-
# STDIN example: cat rule.txt | python3 create_rule.py -f -
106112
help="path of a file with the desired rule's content, or - for STDIN",
107113
)
108114
args = parser.parse_args()

‎detect/v1alpha/delete_rule.py‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
#!/usr/bin/env python3
2+
3+
# Copyright 2024 Google LLC
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
r"""Executable sample for deleting a rule.
18+
19+
Sample Commands (run from api_samples_python dir):
20+
python3 -m detect.v1alpha.delete_rule -r=<region> \
21+
-p=<project_id> -i=<instance_id> \
22+
-rid=<rule_id>
23+
24+
API reference:
25+
https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules/delete
26+
"""
27+
28+
import argparse
29+
import json
30+
from typing import Any, Mapping
31+
32+
from common import chronicle_auth
33+
from common import project_id
34+
from common import project_instance
35+
from common import regions
36+
from google.auth.transport import requests
37+
38+
CHRONICLE_API_BASE_URL = "https://chronicle.googleapis.com"
39+
40+
SCOPES = [
41+
"https://www.googleapis.com/auth/cloud-platform",
42+
]
43+
44+
45+
def delete_rule(
46+
http_session: requests.AuthorizedSession,
47+
proj_region: str,
48+
proj_id: str,
49+
proj_instance: str,
50+
rule_id: str,
51+
) -> Mapping[str, Any]:
52+
"""Deletes a rule.
53+
54+
Args:
55+
http_session: Authorized session for HTTP requests.
56+
proj_region: region in which the target project is located
57+
proj_id: GCP project id or number which the target instance belongs to
58+
proj_instance: uuid of the instance (with dashes)
59+
rule_id: Unique ID of the detection rule to retrieve ("ru_<UUID>").
60+
61+
Returns:
62+
an empty response
63+
64+
Raises:
65+
requests.exceptions.HTTPError: HTTP request resulted in an error
66+
(response.status_code >= 400).
67+
"""
68+
base_url_with_region = regions.url_always_prepend_region(
69+
CHRONICLE_API_BASE_URL,
70+
args.region
71+
)
72+
# pylint: disable-next=line-too-long
73+
parent = f"projects/{proj_id}/locations/{proj_region}/instances/{proj_instance}"
74+
url = f"{base_url_with_region}/v1alpha/{parent}/rules/{rule_id}"
75+
76+
# See API reference links at top of this file, for response format.
77+
response = http_session.request("DELETE", url)
78+
if response.status_code >= 400:
79+
print(response.text)
80+
response.raise_for_status()
81+
return response.json()
82+
83+
84+
if __name__ == "__main__":
85+
parser = argparse.ArgumentParser()
86+
chronicle_auth.add_argument_credentials_file(parser)
87+
regions.add_argument_region(parser)
88+
project_instance.add_argument_project_instance(parser)
89+
project_id.add_argument_project_id(parser)
90+
parser.add_argument(
91+
"-rid",
92+
"--rule_id",
93+
type=str,
94+
required=True,
95+
help='ID of rule to be deleted. In the form of "ru_<UUID>"',
96+
)
97+
args = parser.parse_args()
98+
auth_session = chronicle_auth.initialize_http_session(
99+
args.credentials_file,
100+
SCOPES
101+
)
102+
print(
103+
json.dumps(
104+
delete_rule(
105+
auth_session,
106+
args.region,
107+
args.project_id,
108+
args.project_instance,
109+
args.rule_id,
110+
),
111+
indent=2,
112+
)
113+
)

0 commit comments

Comments
 (0)