Expand v1alpha coverage; Add packaging and a CLI

[dandye]

Install the CLI

make install

CLI Commands and Subcommands

# chronicle --help

# top-level subcommands
chronicle detect --help  #     Detection API commands.
chronicle ingestion --help  #  Ingestion API commands.
chronicle iocs --help  #       IoCs API commands.
chronicle lists --help  #      Lists API commands.
chronicle search --help  #     Search API commands.

# chronicle detect --help
chronicle detect alerts --help  #      Alert management commands.
chronicle detect detections --help  #  Detection management commands.
chronicle detect errors --help  #      Error management commands.
chronicle detect retrohunts --help  #  Retrohunt management commands.
chronicle detect rules --help  #       Rule management commands.
chronicle detect rulesets --help  #    Rule set deployment commands.

# chronicle detect alerts --help 
chronicle detect alerts bulk-update --help  #  Bulk update alerts matching a filter.
chronicle detect alerts get --help  # Get an alert by ID.
chronicle detect alerts update --help # Update an alert.

# chronicle detect detections --help
chronicle detect detections get --help  #   Get a detection by ID.
chronicle detect detections list --help  # List detections.

chronicle detect errors list --help

# chronicle detect retrohunts --help
chronicle detect retrohunts create --help # Create a new retrohunt.
chronicle detect retrohunts get --help  # Get a retrohunt by ID.

# chronicle detect rules --help
chronicle detect rules create --help  #  Create a new rule.
chronicle detect rules delete --help  #  Delete a rule.
chronicle detect rules enable --help  #  Enable a rule.
chronicle detect rules get --help  #     Get a rule by ID.
chronicle detect rules list --help  #    List rules.

# chronicle detect rulesets --help
chronicle detect rulesets batch-update --help  #  Batch update rule set deployments.

# chronicle ingestion --help 
chronicle ingestion batch-get-events --help  #  Batch get events by IDs.
chronicle ingestion get-event --help  #  Get event details by ID.
chronicle ingestion import-events --help  #  Import events into Chronicle.

# chronicle iocs --help 
chronicle iocs batch-get --help  # Get multiple IoCs by their values.
chronicle iocs get --help  # Get a single IoC by its value.
chronicle iocs get-state --help  # Get the state of an IoC by its value.

# chronicle lists --help
chronicle lists create --help  # Create a new list.
chronicle lists get --help  # Get a list by ID.
chronicle lists patch --help  # Update an existing list.

# chronicle search --help
chronicle search find-asset-events --help  # Find asset events within a time range.
chronicle search find-raw-logs --help  # Find raw logs based on search criteria.
chronicle search find-udm-events --help  # Find UDM events based on tokens or event IDs.
chronicle search get-search-query --help  # Get a search query by ID.

New API resources

Help on CLI for chronicle detect detections get

❯ chronicle detect detections get --help
Usage: chronicle detect detections get [OPTIONS]

  Get a detection by ID.

Options:
  --region TEXT            Region in which the target project is located. Can
                           also be set via CHRONICLE_REGION env var.
  --project-instance TEXT  Customer ID (uuid with dashes) for the Chronicle
                           instance. Can also be set via CHRONICLE_INSTANCE
                           env var.
  --project-id TEXT        GCP project id or number. Can also be set via
                           CHRONICLE_PROJECT_ID env var.
  --credentials-file TEXT  Path to service account credentials file. Can also
                           be set via CHRONICLE_CREDENTIALS_FILE env var.
  --env-file TEXT          Path to .env file containing configuration
                           variables.
  --detection-id TEXT      Identifier for the detection.  [required]
  --rule-id TEXT           Identifier for the rule that created the detection.
              

CLI Usage example for chronicle detect detections get

❯ chronicle detect detections get \
  --detection-id "de_92092e71-3baa-0ebf-f230-4aacc5952c63" \
  --rule-id "ru_bf30236c-13af-4a85-a3af-5d58205e10f0"
{
  "type": "RULE_DETECTION",
  "detection": [
    {
      "ruleName": "ttp_powershell_decodebase64_ns139797",
      ...

Help for detect.v1alpha.get_detection

❯ python3 -m detect.v1alpha.get_detection --help
usage: get_detection.py [-h] [-c CREDENTIALS_FILE] -i PROJECT_INSTANCE -p PROJECT_ID
                        [-r {asia-northeast1,asia-south1,asia-southeast1,australia-southeast1,eu,europe,europe-west12,europe-west2,europe-west3,europe-west6,europe-west9,me-central1,me-central2,me-west1,northamerica-northeast2,southamerica-east1,us}]
                        --detection_id DETECTION_ID --rule_id RULE_ID

options:
  -h, --help            show this help message and exit
  -c CREDENTIALS_FILE, --credentials_file CREDENTIALS_FILE
                        credentials file path (default: '/Users/dandye/.chronicle_credentials.json')
  -i PROJECT_INSTANCE, --project_instance PROJECT_INSTANCE
                        Customer ID for Chronicle instance
  -p PROJECT_ID, --project_id PROJECT_ID
                        Your BYOP, project id
  -r {asia-northeast1,asia-south1,asia-southeast1,australia-southeast1,eu,europe,europe-west12,europe-west2,europe-west3,europe-west6,europe-west9,me-central1,me-central2,me-west1,northamerica-northeast2,southamerica-east1,us}, --region {asia-northeast1,asia-south1,asia-southeast1,australia-southeast1,eu,europe,europe-west12,europe-west2,europe-west3,europe-west6,europe-west9,me-central1,me-central2,me-west1,northamerica-northeast2,southamerica-east1,us}
                        the region where the customer is located (default: us)
  --detection_id DETECTION_ID
                        Identifier for the detection
  --rule_id RULE_ID     Identifier for the rule that created the detection

Usage example

❯ PROJECT_INSTANCE=7e977ce4-f45d-43b2-aea0-52f8b66acd80
PROJECT_ID=dandye-0324-chronicle
python3 -m detect.v1alpha.get_detection \
 --project_instance=$PROJECT_INSTANCE  \
 --project_id=$PROJECT_ID \
 --detection_id "de_92092e71-3baa-0ebf-f230-4aacc5952c63" \
 --rule_id "ru_bf30236c-13af-4a85-a3af-5d58205e10f0"
{
  "type": "RULE_DETECTION",
  "detection": [
    {
      "ruleName": "ttp_powershell_decodebase64_ns139797",