SDK bugs

Author: dandye

detect/v1alpha/get_detection.py

@@ -22,7 +22,8 @@
     --project_id=<PROJECT_ID> \
     --project_instance=<PROJECT_INSTANCE> \
     --region=<REGION> \
-    --detection_id=<DETECTION_ID>
+    --detection_id=<DETECTION_ID> \
+    --rule_id=<RULE_ID>
 
 API reference:
 https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetDetection
@@ -51,6 +52,7 @@ def get_detection(
     proj_instance: str,
     proj_region: str,
     detection_id: str,
+    rule_id: str,
 ) -> Mapping[str, Any]:
   """Gets a Detection using the Legacy Get Detection API.
 
@@ -60,6 +62,7 @@ def get_detection(
     proj_instance: Customer ID (uuid with dashes) for the Chronicle instance.
     proj_region: region in which the target project is located.
     detection_id: Identifier for the detection.
+    rule_id: Identifier for the rule that created the detection.
 
   Returns:
     Dictionary representation of the Detection.
@@ -78,7 +81,7 @@ def get_detection(
   url = f"{base_url_with_region}/v1alpha/{parent}/legacy:legacyGetDetection"
   # pylint: enable=line-too-long
 
-  query_params = {"detectionId": detection_id}
+  query_params = {"detectionId": detection_id, "ruleId": rule_id}
 
   response = http_session.request("GET", url, params=query_params)
   if response.status_code >= 400:
@@ -100,6 +103,10 @@ def get_detection(
                       type=str,
                       required=True,
                       help="Identifier for the detection")
+  parser.add_argument("--rule_id",
+                      type=str,
+                      required=True,
+                      help="Identifier for the rule that created the detection")
 
   args = parser.parse_args()
 
@@ -111,5 +118,6 @@ def get_detection(
       args.project_instance,
       args.region,
       args.detection_id,
+      args.rule_id,
   )
   print(json.dumps(detection, indent=2))

detect/v1alpha/list_detections.py

@@ -94,7 +94,7 @@ def list_detections(http_session: requests.AuthorizedSession,
       (response.status_code >= 400).
   """
   base_url_with_region = regions.url_always_prepend_region(
-      CHRONICLE_API_BASE_URL, args.region)
+      CHRONICLE_API_BASE_URL, proj_region)
   # pylint: disable-next=line-too-long
   parent = f"projects/{proj_id}/locations/{proj_region}/instances/{proj_instance}"
   url = f"{base_url_with_region}/v1alpha/{parent}/legacy:legacySearchDetections"

iocs/__init__.py

@@ -170,8 +170,13 @@ def detections():
     required=True,
     help="Identifier for the detection.",
 )
+@click.option(
+    "--rule-id",
+    required=True,
+    help="Identifier for the rule that created the detection.",
+)
 def get_detection_cmd(credentials_file, project_id, project_instance, region,
-                      detection_id):
+                      detection_id, rule_id):
   """Get a detection by ID."""
   auth_session = chronicle_auth.initialize_http_session(
       credentials_file,
@@ -183,6 +188,7 @@ def get_detection_cmd(credentials_file, project_id, project_instance, region,
       project_instance,
       region,
       detection_id,
+      rule_id,
   )
   print(json.dumps(detection, indent=2))
 
@@ -211,9 +217,9 @@ def list_detections_cmd(credentials_file, project_id, project_instance, region,
   )
   result = list_detections.list_detections(
       auth_session,
+      region,
       project_id,
       project_instance,
-      region,
       filter,
       page_size,
       page_token,

iocs/v1alpha/__init__.py

@@ -23,9 +23,6 @@
 from lists.v1alpha import create_list
 from lists.v1alpha import get_list
 from lists.v1alpha import patch_list
-from reference_lists.v1alpha import create_reference_list
-from reference_lists.v1alpha import get_reference_list
-from reference_lists.v1alpha import list_reference_lists
 from sdk.commands.common import add_common_options
 
 SCOPES = [
@@ -137,116 +134,7 @@ def patch_list_cmd(credentials_file, project_id, project_instance, region,
   print(json.dumps(result, indent=2))
 
 
-@lists.group()
-def reference():
-  """Reference Lists API commands."""
-  pass
-
-
-@reference.command("create")
-@add_common_options
-@click.option(
-    "--reference-list-id",
-    required=True,
-    help="ID to use for the new reference list.",
-)
-@click.option(
-    "--entries",
-    required=True,
-    help="JSON array of strings to add to the reference list.",
-)
-@click.option(
-    "--syntax-type",
-    type=click.Choice([
-        "REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED",
-        "REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING",
-        "REFERENCE_LIST_SYNTAX_TYPE_REGEX", "REFERENCE_LIST_SYNTAX_TYPE_CIDR"
-    ]),
-    default="REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING",
-    help="Type of entries in the list.",
-)
-@click.option(
-    "--scope-names",
-    help="Optional JSON array of scope names.",
-)
-@click.option(
-    "--description",
-    help="Optional description of the reference list.",
-)
-def create_reference_list_cmd(credentials_file, project_id, project_instance,
-                              region, reference_list_id, entries, syntax_type,
-                              scope_names, description):
-  """Create a new reference list."""
-  auth_session = chronicle_auth.initialize_http_session(
-      credentials_file,
-      SCOPES,
-  )
 
-  entries_list = json.loads(entries)
-  scope_names_list = json.loads(scope_names) if scope_names else None
 
-  result = create_reference_list.create_reference_list(
-      auth_session,
-      project_id,
-      project_instance,
-      region,
-      reference_list_id,
-      entries_list,
-      syntax_type,
-      scope_names_list,
-      description,
-  )
-  print(json.dumps(result, indent=2))
 
 
-@reference.command("get")
-@add_common_options
-@click.option(
-    "--reference-list-id",
-    required=True,
-    help="ID of the reference list to retrieve.",
-)
-def get_reference_list_cmd(credentials_file, project_id, project_instance,
-                           region, reference_list_id):
-  """Get a reference list by ID."""
-  auth_session = chronicle_auth.initialize_http_session(
-      credentials_file,
-      SCOPES,
-  )
-  result = get_reference_list.get_reference_list(
-      auth_session,
-      project_id,
-      project_instance,
-      region,
-      reference_list_id,
-  )
-  print(json.dumps(result, indent=2))
-
-
-@reference.command("list")
-@add_common_options
-@click.option(
-    "--page-size",
-    type=int,
-    help="Optional maximum number of reference lists to return.",
-)
-@click.option(
-    "--page-token",
-    help="Optional page token from a previous response for pagination.",
-)
-def list_reference_lists_cmd(credentials_file, project_id, project_instance,
-                             region, page_size, page_token):
-  """List reference lists."""
-  auth_session = chronicle_auth.initialize_http_session(
-      credentials_file,
-      SCOPES,
-  )
-  result = list_reference_lists.list_reference_lists(
-      auth_session,
-      project_id,
-      project_instance,
-      region,
-      page_size,
-      page_token,
-  )
-  print(json.dumps(result, indent=2))