Google Security Operations CLI 用户指南
支持以下语言：
Google SecOps
SIEM
作为使用 Google Security Operations 图形界面的替代方案，高级用户可以使用 Google Security Operations 命令行界面 (CLI) chronicle_cli 启动 Google Security Operations 工作流。
您可以将 Google Security Operations CLI 用于以下工作流：
Google Security Operations CLI 命令使用以下语法（COMMAND 和 ARGUMENT 是必需的，但 OPTIONS 是可选的）：
$ chronicle_cli COMMAND ARGUMENT [OPTIONS]
例如，要使用 Feed 管理工作流程创建新 Feed，请使用以下命令：
$ chronicle_cli feeds create
准备工作
在安装 Google Security Operations CLI 之前，请执行以下操作：
- 在您的环境中安装 Python 3。有关详情，请参阅安装 Python。
- 创建并激活虚拟环境。如需了解详情，请参阅 使用 pip 和虚拟环境安装软件包。
- 在您的主目录中创建一个名为
.chronicle_cli的隐藏目录，并将您的 Google 开发者服务账号凭据放入其中，并命名为chronicle_credentials.json。您的 Google Security Operations 代表会为您提供 Google 开发者服务账号凭据。Google Developer 服务账号凭据让chronicle_cli能够与 API 进行通信。 如果您打算使用解析器管理 v2 命令，则必须执行以下操作：
- 将您的 Google Security Operations 实例绑定到您拥有的项目。请参阅以下文档：
- 在绑定到 Google Security Operations 的项目中创建一个服务账号。如需了解详情，请参阅创建和管理服务账号密钥。
- 向服务账号授予 Chronicle API Admin (
roles/chronicle.admin) 角色。
安装
本部分介绍如何在以下位置安装 Google Security Operations CLI 您的环境
创建并激活虚拟环境
venv。使用以下命令克隆代码库：
git clone https://github.com/chronicle/cli.git打开一个终端，并将所有必需的依赖软件包安装到您的 来启动容器：
$ cd cli $ (env) pip install -r requirements.txt通过执行以下命令安装 Google Security Operations 二进制文件：
$ (env) python3 -m pip install --editable .通过执行以下命令验证安装是否成功：
$ chronicle_cli --help
示例输出
Usage: chronicle_cli [OPTIONS] COMMAND [ARGS]...
Google Security Operations CLI is a CLI tool for managing Google Security Operations user workflows for e.g.
Feed Management workflows.
Options:
-h, --help Show this message and exit.
Commands:
feeds Feed Management Workflows
选项
您可以替换默认配置，只需在运行命令时提供其他标志即可。
设置默认区域 (--region)
您可以通过将 --region 标志与命令一起传递来选择区域和
API 调用将对相应的 Google Security Operations 区域后端进行。
您可以设置以下区域：
ASIA-NORTHEAST1ASIA-SOUTH1ASIA-SOUTHEAST1AUSTRALIA-SOUTHEAST1EUROPEEUROPE-WEST2EUROPE-WEST3EUROPE-WEST6EUROPE-WEST12ME-CENTRAL1ME-CENTRAL2ME-WEST1NORTHAMERICA-NORTHEAST2US
如果您未指定区域，则系统会将默认区域设置为 US。
Feed 管理工作流
您可以使用 Google Security Operations CLI 创建和管理 Google SecOps 实例。
命令
feeds 命令
feeds 命令采用以下参数：
createupdategetlistdeleteenabledisable
使用语法：
$ chronicle_cli feeds ARGUMENT [OPTIONS]
参数
create 参数
创建新 Feed。
用法示例
$ chronicle_cli feeds create --help
Usage: chronicle_cli feeds create [OPTIONS]
Create a feed
Options:
--url TEXT Base URL to be used for API calls.
--region
Select region.
--verbose Prints verbose output to the console.
-c, --credential-path TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cli/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
- 对于 Windows 平台
====================================
========== Set Properties ==========
====================================
List of Source types:
1. Amazon S3
2. Amazon SQS
3. Google Cloud Storage
4. HTTP(S) URI
5. Microsoft Azure Blob Storage
6. SFTP
7. Third party API
[Source type] Enter your choice: 7
You have selected Third party API
List of Log types:
(i) How to select log type?
- Press ENTER key (scrolls one line at a time) or SPACEBAR key (display next screen).
- Note down the choice number for the log type that you want to select.
- Press 'q' to quit and enter that choice number.
=============================================================================
1. Anomali
2. Azure AD
3. Azure AD Directory Audit
4. Azure AD Organizational Context
5. Cloud Passage
6. Duo Auth
7. Duo User Context
8. Fox-IT
9. Imperva
10. Microsoft Graph API Alerts:
[Log type] Enter your choice: 7
You have selected Duo User Context
Enter feed display name: my_duo_user_context_feed
======================================
=========== Input Parameters =========
======================================
(*) - Required fields.
Password/secret inputs are hidden.
(*) Username (Username to authenticate as)
=> USERNAME
(*) Secret (Secret to authenticate with)
=>
(*) API hostname (The fully qualified domain name for your instance of the API, having the form "api-xxxxxxxx.duosecurity.com")
=> api-xxxxxxxx.duosecurity.com
Feed created successfully with Feed ID: 9cfce415-97df-413b-8e38-e7c747f9ed38
- 对于其他平台，例如 Linux/Ubuntu/CentOS/MacOS
====================================
========== Set Properties ==========
====================================
List of Source types:
1. Amazon S3
2. Amazon SQS
3. Google Cloud Storage
4. HTTP(S) URI
5. Microsoft Azure Blob Storage
6. SFTP
7. Third party API
[Source type] Enter your choice: 7
You have selected Third party API
List of Log types:
(i) How to select log type?
- Press Up/b or Down/z keys to paginate.
- To switch case-sensitivity, press '-i' and press enter. By default, search
is case-sensitive.
- To search for specific log type, press '/' key, enter text and press enter.
- Note down the choice number for the log type that you want to select.
- Press 'q' to quit and enter that choice number.
- Press `h` for all the available options to navigate the list.
=============================================================================
1. Anomali
2. Azure AD
3. Azure AD Directory Audit
4. Azure AD Organizational Context
5. Cloud Passage
6. Duo Auth
7. Duo User Context
8. Fox-IT
9. Imperva:
[Log type] Enter your choice: 7
You have selected Duo User Context
======================================
======================================
(*) - Required fields.
Password/secret inputs are hidden.
(*) Username (Username to authenticate as)
=> USERNAME
(*) Secret (Secret to authenticate with)
=>
(*) API hostname (The fully qualified domain name for your instance of the API, having the form "api-xxxxxxxx.duosecurity.com")
=> api-xxxxxxxx.duosecurity.com
Feed created successfully with Feed ID: 9cfce415-97df-413b-8e38-e7c747f9ed38
如果 Feed 创建失败，系统会在下次提示您重试失败的 Feed 创建。您可以选择重试或继续创建新 Feed。重试机制 让您能够以交互方式更改在上一次失败尝试中提供的值。 按 Enter 键即可在 Feed 创建流程中将相同的值重复用于某个选项。
示例输出
====================================
========== Set Properties ==========
====================================
List of Source types:
1. Amazon S3
2. Amazon SQS
3. Google Cloud Storage
4. HTTP(S) URI
5. Microsoft Azure Blob Storage
6. SFTP
7. Third party API
[Source type] Enter your choice: 7
You have selected Third party API
[Log type] Enter your choice: 6
You have selected Duo Auth
Enter feed display name: my_duo_auth_feed
======================================
=========== Input Parameters =========
======================================
(*) - Required fields.
Password/secret inputs are hidden.
(*) Username (Username to authenticate as)
=> test
(*) Secret (Secret to authenticate with)
=>
(*) API hostname (The fully qualified domain name for your instance of the API, having the form "api-xxxxxxxx.duosecurity.com")
=> test.com
Error occurred while creating feed.
Response Code: 400.
Error: generic::invalid_argument: failed to create feed for the customer (ID: ed19f037-2354-43df-bfbf-350362b45844): failed to create feed for the customer (ID: ed19f037-2354-43df-bfbf-350362b45844): failed to create feed because of the following errors in the request: generic::invalid_argument: for Duo feeds, 'hostname' must be specified as "api-xxxxxxxx.duosecurity.com", e.g. "api-eval.duosecurity.com"
$ chronicle_cli feeds create
Looks like there was a failed feed create/update attempt with source type: Third party API and log type: Duo Auth.
Would you like to retry?
======================================
=========== Input Parameters =========
======================================
(*) - Required fields.
Password/secret inputs are hidden.
(*) Username (Username to authenticate as) [test]
=>
(*) Secret (Secret to authenticate with)
=>
(*) API hostname (The fully qualified domain name for your instance of the API, having the form "api-xxxxxxxx.duosecurity.com") [test.com]
=> api-xxxxxxxx.duosecurity.com
Feed created successfully with Feed ID: 29a2f967-6f6e-4521-bebf-6fb6c7383df6
get 参数
获取现有 Feed 的详细信息。
用法示例
$ chronicle_cli feeds get --help
Usage: main feeds get [OPTIONS]
Get feed details using Feed ID
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential-path TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cli/chronicle_credentials.json
-h, --help Show this message and exit.
您必须以交互方式输入 Feed ID 才能获取 Feed 详情。
示例输出
Enter Feed ID: 72d9b843-b387-4b17-ab2d-a8497313c89c
Feed Details:
ID: 72d9b843-b387-4b17-ab2d-a8497313c89c
Display Name: my_duo_auth_feed
Source type: Third party API
Log type: Salesforce
State: ACTIVE
Feed Settings:
API Hostname: myinstance.salesforce.com
list 参数
列出所有 Feed。此命令用于提取所有 Feed 的详细信息。
用法示例
$ chronicle_cli feeds list --help
Usage: chronicle_cli feeds list [OPTIONS]
List all feeds
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
--export TEXT Export output to specified file path.
--file-format [TXT|CSV|JSON] Format of the file to be exported.
-c, --credential-path TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cli/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
Feed Details:
ID: 29259301-156b-4b60-ae91-855d15c39f6a
Source type: Third party API
Log type: Anomali
State: INACTIVE
============================================================
Feed Details:
ID: 292b7629-0250-476c-9fb2-4c8a738ce42c
Display Name: my_duo_auth_feed
Source type: Third party API
Log type: Duo Auth
State: ACTIVE
Feed Settings:
API hostname: api-test.duosecurity.com
============================================================
Feed Details:
ID: 0d063a7f-34a1-4dd0-9dcf-9c7a0bb03e65
Source type: Third party API
Log type: Workspace Activities
State: ACTIVE
Feed Settings:
Customer ID: C12abc
Applications: ['drive', 'login']
============================================================
如果您要导出数据，则可以指定绝对/相对路径 要导出的文件的内容以及文件格式 (CSV/TXT/JSON)。默认文件格式为 CSV。
示例输出
Feed Details:
ID: 29259301-156b-4b60-ae91-855d15c39f6a
Source type: Third party API
Log type: Anomali
State: INACTIVE
============================================================
Feed Details:
ID: 292b7629-0250-476c-9fb2-4c8a738ce42c
Display Name: my_duo_auth_feed
Source type: Third party API
Log type: Duo Auth
State: ACTIVE
Feed Settings:
API hostname: api-test.duosecurity.com
============================================================
Feed Details:
ID: 0d063a7f-34a1-4dd0-9dcf-9c7a0bb03e65
Source type: Third party API
Log type: Workspace Activities
State: ACTIVE
Feed Settings:
Customer ID: C12abc
Applications: ['drive', 'login']
============================================================
Feed list details exported successfully to: /usr/local/google/home/<user>/out/chronicle-cli/output.txt
update 参数
更新现有 Feed。
用法示例
$ chronicle_cli feeds update
Usage: chronicle_cli feeds update [OPTIONS]
Update feed details using Feed ID
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential-path TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cli/chronicle_credentials.json
-h, --help Show this message and exit.
运行此命令后，再次输入 Feed ID 和所有字段值。 按 Enter 键可重用旧值。
示例输出
Enter Feed ID: ea28d66b-d81b-4b4d-ae16-3b1cd98132ca
Press Enter if you don't want to update.
Enter feed display name[old_display_name]:
(*) Username (Username to authenticate as)
=> USERNAME
(*) Secret (Secret to authenticate with)
=>
(*) API hostname (The fully qualified domain name for your instance of the API, having the form "api-xxxxxxxx.duosecurity.com") [api-xxxxxxxx.duosecurity.com]
=>
Feed updated successfully with Feed ID: ea28d66b-d81b-4b4d-ae16-3b1cd98132ca
Enter Feed ID: 29a2f967-6f6e-4521-bebf-6fb6c7383df6
Press Enter if you don't want to update.
Enter feed display name[]: my_feed_display_name
(*) Username (Username to authenticate as)
=> test1
(*) Secret (Secret to authenticate with)
=>
(*) API hostname (The fully qualified domain name for your instance of the API, having the form "api-xxxxxxxx.duosecurity.com") [api-xxxxxxxx.duosecurity.com]
=> test.com
Error occurred while updating feed. Response code: 400.
Error: generic::invalid_argument: failed to update feed for the customer (ID: ed19f037-2354-43df-bfbf-350362b45844): failed to edit feed because of the following errors in the request: generic::invalid_argument: for Duo feeds, 'hostname' must be specified as "api-xxxxxxxx.duosecurity.com", e.g. "api-eval.duosecurity.com"
$ chronicle_cli feeds update
Enter Feed ID: 29a2f967-6f6e-4521-bebf-6fb6c7383df6
Looks like there was a failed feed create/update attempt with source type: Third party API and log type: Duo Auth.
Would you like to retry?
Press Enter if you don't want to update.
(*) Username (Username to authenticate as) [test1]
=>
(*) Secret (Secret to authenticate with)
=>
(*) API hostname (The fully qualified domain name for your instance of the API, having the form "api-xxxxxxxx.duosecurity.com") [test.com]
=> api-devtest.duosecurity.com
Feed updated successfully with Feed ID: 29a2f967-6f6e-4521-bebf-6fb6c7383df6
如果 Feed 更新失败，您输入的是同一 Feed ID，系统会显示提示 重试失败的 Feed 或重新启动该过程。如果您输入的 Feed ID 与失败的 Feed ID 不匹配，系统不会显示重新尝试的选项，并会继续正常更新 Feed 的流程。重试机制让您可以 更改上一次互动失败的尝试中提供的选项值 。按 Enter 键即可将相同的值重复用于 Feed 更新流程中的选项。
示例输出
Enter Feed ID: 51574667-dee6-408b-a5fc-0e07d3e9a429
Looks like there was a failed feed create/update attempt with source type: Third party API and log type: Duo Auth.
Would you like to retry?
Press Enter if you don't want to update.
Enter feed display name[old_display_name]:
(*) Username (Username to authenticate as) [TEEST]
=> TEST
(*) Secret (Secret to authenticate with)
=>
(*) API hostname (The fully qualified domain name for your instance of the API, having the form "api-xxxxxxxx.duosecurity.com") [asd]
=> api-xxxxxxxx.duosecurity.com
Feed updated successfully with Feed ID: 51574667-dee6-408b-a5fc-0e07d3e9a429
delete 参数
使用此参数可删除使用 Feed ID 的 Feed。在执行时，它会要求删除 Feed 的 ID。
用法示例
$ chronicle_cli feeds delete --help
Usage: chronicle_cli feeds delete [OPTIONS]
Delete a feed
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
-c, --credential-path TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cli/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
Enter Feed ID: b0798c54-ed84-44e7-96d5-cbe208f28e49
Feed (ID: b0798c54-ed84-44e7-96d5-cbe208f28e49) deleted successfully.
enable 参数
启用 Feed。
用法示例
$ chronicle_cli feeds enable --help
Usage: main feeds enable [OPTIONS]
Enable feed for the given Feed ID
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential-path TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
您必须输入 Feed ID 才能启用 Feed。
示例输出
Enter Feed ID: 29259301-156b-4b60-ae91-855d15c39f6a
Feed with ID: 29259301-156b-4b60-ae91-855d15c39f6a enabled successfully.
disable 参数
停用 Feed。
用法示例
$ chronicle_cli feeds disable --help
Usage: main feeds disable [OPTIONS]
Disable feed for the given Feed ID
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential-path TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
您必须输入 Feed ID 才能停用 Feed。
示例输出
Enter Feed ID: 29259301-156b-4b60-ae91-855d15c39f6a
Feed with ID: 29259301-156b-4b60-ae91-855d15c39f6a disabled successfully.
选项
帮助 (-h / --help)
使用 -h 或 -- 帮助选项可查看任何命令/选项的用法/说明。
用法示例
$ chronicle_cli feeds get -h
Usage: main feeds get [OPTIONS]
Get feed details using Feed ID
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console
-c, --credential-path TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cli/chron
icle_credentials.json
-h, --help Show this message and exit.
凭据路径（-c 或 --credential-path）
此选项允许指定服务账号的路径
身份验证凭据。如果未指定此选项
Google Security Operations CLI 会在默认路径中查找凭据，
即 ~/.chronicle_cli（在主目录下名为 .chronicle_cli 的隐藏目录中）。
用法示例
$ chronicle_cli feeds list --credential-path=C:\chronicle_credentials.json
详细（--verbose）
使用此标志时，Google Security Operations CLI 会向控制台输出更多详细信息，例如 HTTP 请求和响应。
用法示例
$ chronicle_cli feeds list --verbose
导出 (--export)
通过此选项，您可以指定 list 输出
命令将导出同时支持相对路径和绝对路径。
用法示例
$ chronicle_cli feeds list --export=$HOME/listFeedsResponse.txt
文件格式 (--file-format)
通过此选项，您可以指定使用
list 命令。支持以下三种格式：CSV、JSON 和 TXT。如果
选项未指定 --export 选项，则系统会默认使用 CSV 格式。
用法示例
$ chronicle_cli feeds list --export=$HOME/listFeedsResponse.txt --file-format=TXT
示例输出
CSV 格式
ID,Display Name,Source type,Log type,State,Feed Settings
29259301-156b-4b60-ae91-855d15c39f6a,,Third party API,Anomali,INACTIVE,
292b7629-0250-476c-9fb2-4c8a738ce42c,my_duo_auth_feed,Third party API,Duo Auth,ACTIVE,API hostname: api-xxxxxxxxabjdsfklsadlfnsafs.duosecurity.com
0d063a7f-34a1-4dd0-9dcf-9c7a0bb03e65,,Third party API,Workspace Activities,ACTIVE,"Customer ID: C12abc Applications: ['drive', 'login']"
TXT 格式
Feed Details:
ID: 29259301-156b-4b60-ae91-855d15c39f6a
Source type: Third party API
Log type: Anomali
State: INACTIVE
============================================================
Feed Details:
ID: 292b7629-0250-476c-9fb2-4c8a738ce42c
Display Name: my_duo_auth_feed
Source type: Third party API
Log type: Duo Auth
State: ACTIVE
Feed Settings:
API hostname: api-test.duosecurity.com
============================================================
JSON 格式
[
{
"name": "feeds/29259301-156b-4b60-ae91-855d15c39f6a",
"details": {
"logType": "ANOMALI_IOC",
"feedSourceType": "API",
"anomaliSettings": {}
},
"feedState": "INACTIVE"
},
{
"name": "feeds/292b7629-0250-476c-9fb2-4c8a738ce42c",
"details": {
"logType": "DUO_AUTH",
"feedSourceType": "API",
"duoAuthSettings": {
"hostname": "api-test.duosecurity.com"
}
},
"feedState": "ACTIVE",
"displayName": "my_duo_auth_feed"
}
]
区域 (--region)
您可以在运行命令时通过传递 --region 标志来选择区域。如需详细了解如何设置默认区域，请参阅设置默认区域。
问题排查
本部分根据从 API 响应收到的不同类型的响应代码，显示在控制台上对应的输出。
get 参数响应代码
| 响应代码 | 控制台输出 |
| 404 | Feed ID 无效。请输入有效的 Feed ID。 |
| 400 | Feed 不存在。 |
| 任何其他响应代码 | 提取 Feed 时出错。
响应代码：{status code}
错误：{error message}
|
list 参数响应代码
| 响应代码 | 控制台输出 |
| 200 以外的任何响应代码 | 提取 Feed 列表时出错。
响应代码：{status code}
错误：{error message}
|
| 列表中的任何 Feed 提取失败 | 在控制台输出的末尾，系统会输出一个列表，其中包含 Feed ID 的详细信息和相应的错误消息。 |
create 参数响应代码
| 响应代码 | 控制台输出 |
| 200 以外的任何响应代码 | 创建 Feed 时出错。
响应代码：{status code}
错误：{error message}
|
update 参数响应代码
| 响应代码 | 控制台输出 |
| 除 200 以外的任何响应代码 | 更新 Feed 时出错。响应代码：{status code}
错误：{error message}
|
delete 参数响应代码
| 响应代码 | 控制台输出 |
| 404 | Feed ID 无效。请输入有效的 Feed ID。 |
| 400 | Feed 不存在。 |
| 任何其他响应代码 | 删除 Feed 时出错。
响应代码：{status code}
错误：{error message}
|
enable 参数响应代码
| 响应代码 | 控制台输出 |
| 404 | Feed ID 无效。请输入有效的 Feed ID。 |
| 400 | Feed 不存在。 |
| 任何其他响应代码 | 启用 Feed 时出错。
响应代码：{status code}
错误：{error message}
|
disable 参数响应代码
| 响应代码 | 控制台输出 |
| 404 | Feed ID 无效。请输入有效的 Feed ID。 |
| 400 | Feed 不存在。 |
| 任何其他响应代码 | 停用 Feed 时出错。
响应代码：{status code}
错误：{error message}
|
其他错误或异常
| 异常 | 控制台输出 |
| KeyError | 未能在响应中找到键 {key name}。
|
| 异常 | 失败，出现异常：{exception details}
|
| 缺少凭据文件 | 失败，但发生异常：[Errno 2] 没有这样的文件或目录：“/usr/local/google/home/ 您需要将凭据放在预期的目录中。请参阅安装。 |
解析器管理 v2 用户工作流
您可以使用 Google SecOps CLI 来管理基于配置的标准化程序 (CBN) 解析器。我们建议您使用解析器管理 v2 CLI 命令。
命令
parsers 命令
parsers 命令采用以下参数：
list_parserslist_extensionsrun_parsersubmit_parsersubmit_extensiondelete_parserdelete_extensiondeactivate_parseractivate_parserget_parserget_extensionget_validation_report
用法语法：
$ chronicle_cli parsers ARGUMENT [OPTIONS]
参数
Google SecOps CLI 中的所有 CBN 解析器管理工作流都是交互式的。如果需要，您还可以使用命令选项。
list_parsers 参数
列出所有解析器。
$ chronicle_cli parsers list_parsers -h
Usage: chronicle_cli parsers list_parsers [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
[New]List all parsers for a given customer
Options:
-s, --state [ALL|ACTIVE|INACTIVE]
Filter on Parser State.
-f, --file-format [TXT|JSON] Format of the file to be exported.
--export TEXT Export output to specified file path.
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Fetching list of parsers... Parser Details: Parser ID: 1242538299340357633 Log type: GCP_CLOUDAUDIT State: INACTIVE Type: CUSTOM Author: - Validation Report ID: 44684d8a-1d01-4e69-ab50-2e2d6e3ef3b2 Create Time: 2023-07-05T05:36:31.121236Z ============================================================ Parser Details: Parser ID: 3840440184193679361 Log type: GCP_CLOUDAUDIT State: INACTIVE Type: CUSTOM Author: - Validation Report ID: 3d2e1bdb-2793-48d1-a485-4f4748095cb8 Create Time: 2023-04-14T09:15:13.718842Z ============================================================ Parser Details: Parser ID: 3651720008402206721 Log type: GCP_SECURITYCENTER_ERROR State: ACTIVE Type: CUSTOM Author: - Validation Report ID: - Create Time: 2023-03-30T09:54:20.414510Z ============================================================
list_extensions 参数
列出所有解析器扩展。
$ chronicle_cli parsers list_extensions -h
Usage: chronicle_cli parsers list_extensions [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
[New]List all extensions for a given customer
Options:
-f, --file-format [TXT|JSON] Format of the file to be exported.
--export TEXT Export output to specified file path.
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Fetching list of Parser Extensions... ParserExtension Details: ParserExtension ID: 7b948bfb-d3f5-4922-9153-a20e75085990 Log type: BRO_DNS State: VALIDATED Validation Report ID: 6ef30ad9-db89-4f30-80f3-0f79758ff3c2 Create Time: 2023-07-06T03:58:26.594863Z State Last Changed Time: 2023-07-06T03:58:26.667151Z Last Live Time: 2023-07-06T03:58:28.019050Z ============================================================ ParserExtension Details: ParserExtension ID: 0fd9129b-d02b-42f7-912a-04b0bba0e0a7 Log type: GCP_DNS State: LIVE Validation Report ID: 1965880f-7cd7-4943-9adf-4bff0041793d Create Time: 2023-05-12T08:12:17.090559Z State Last Changed Time: 2023-05-12T08:12:17.271615Z Last Live Time: 2023-05-12T08:12:27.244342Z ============================================================ ParserExtension Details: ParserExtension ID: d9df9d75-bb3a-4c28-b18d-69a608762ecc Log type: GCP_VPC_FLOW State: REJECTED Validation Report ID: c59ef2ab-4a70-4373-bdc8-067c39ca5a40 Create Time: 2023-04-13T04:43:12.884287Z State Last Changed Time: 2023-04-13T04:43:13.288338Z Last Live Time: - ============================================================
run_parser 参数
如需根据给定日志验证解析器，请使用以下命令：
$ chronicle_cli parsers run_parser -h
Usage: chronicle_cli parsers run_parser [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
PARSER_CONFIG_FILE LOG_FILE
[New]Run a parser(with extension) against given logs
Options:
--parserextension_config_file TEXT
Path to extension config file.
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Running parser(with extension) against given logs...
{"host_ip": "1.1.1.1"}
{'events': [{'event': {'metadata': {'eventTimestamp': '2023-06-26T08:45:10Z', 'eventType': 'GENERIC_EVENT', 'logType': 'BRO_DNS'}, 'principal': {'ip': ['1.1.1.1']}}}]}
some thing
{}
Runtime: 1.2396s
submit_parser 参数
提交新的解析器。系统会对提交的解析器进行验证，并将现有解析器升级为候选回滚。
$ chronicle_cli parsers submit_parser -h
Usage: main parsers submit_parser [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
CONFIG_FILE [AUTHOR]
[New]Submit a new parser
Options:
--skip_validation_on_no_logs Skip validation if no logs are found.
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Submitting Parser... Parser Details: Parser ID: 12774126091501569 Log type: GCP_CLOUDAUDIT State: INACTIVE Type: CUSTOM Author: - Validation Report ID: - Create Time: 2023-07-06T13:58:10.475391Z ============================================================
submit_extension 参数
提交新的解析器扩展程序。提交的解析器扩展程序将接受验证。如果验证通过，系统会创建新的解析器扩展。
$ chronicle_cli parsers submit_extension -h
Usage: chronicle_cli parsers submit_extension [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
CONFIG_FILE LOG_FILE
[New]Submit a new extension
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Submitting Parser Extension... ParserExtension Details: ParserExtension ID: 88907461-c115-4204-8391-425b7a9cfb2c Log type: WORKSPACE_CHROMEOS State: NEW Validation Report ID: - Create Time: 2023-07-06T13:58:10.475391Z State Last Changed Time: - Last Live Time: - ============================================================
delete_parser 参数
删除自定义解析器。您可以开始针对给定的日志类型使用预构建的解析器。
$ chronicle_cli parsers delete_parser -h
Usage: chronicle_cli parsers delete_parser [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
PARSER_ID
[New]Delete a parser
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Deleting Parser… Parser deleted successfully.
delete_extension 参数
删除自定义解析器。您可以开始针对给定的日志类型使用预构建的解析器。
$ chronicle_cli parsers delete_extension -h
Usage: chronicle_cli parsers delete_extension [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
PARSEREXTENSION_ID
[New]Delete an extension
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Deleting Parser Extension… ParserExtension deleted successfully.
deactivate_parser 参数
停用处于活动状态的自定义解析器。如果停用成功，您可以开始针对给定日志类型使用预构建的解析器。
$ chronicle_cli parsers deactivate_parser -h
Usage: chronicle_cli parsers deactivate_parser [OPTIONS] PROJECT_ID CUSTOMER_ID
LOG_TYPE PARSER_ID
[New]Deactivate a parser
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Deactivating Parser… Parser deactivated successfully.
activate_parser 参数
激活自定义解析器。您可以开始使用活跃解析器。
$ chronicle_cli parsers activate_parser -h
Usage: chronicle_cli parsers activate_parser [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
PARSER_ID
[New]Activate a parser
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Activating Parser… Parser activated successfully.
get_parser 参数
获取指定解析器 ID 和日志类型的详细信息。
$ chronicle_cli parsers get_parser -h
Usage: chronicle_cli parsers get_parser [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
PARSER_ID
[New]Get details of a parser
Options:
-f, --file-format [TXT|JSON] Format of the file to be exported.
--export TEXT Export output to specified file path.
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Fetching Parser details... Parser Details: Parser ID: 3840440184193679361 Log type: GCP_CLOUDAUDIT State: INACTIVE Type: CUSTOM Author: - Validation Report ID: 3d2e1bdb-2793-48d1-a485-4f4748095cb8 Create Time: 2023-04-14T09:15:13.718842Z ============================================================
get_extension 参数
获取指定解析器 ID 和日志类型的配置。
$ chronicle_cli parsers get_extension -h
Usage: chronicle_cli parsers get_extension [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
PARSEREXTENSION_ID
[New]Get details of an extension
Options:
-f, --file-format [TXT|JSON] Format of the file to be exported.
--export TEXT Export output to specified file path.
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Fetching Parser Extension details... ParserExtension Details: ParserExtension ID: 7b948bfb-d3f5-4922-9153-a20e75085990 Log type: BRO_DNS State: VALIDATED Validation Report ID: 6ef30ad9-db89-4f30-80f3-0f79758ff3c2 Create Time: 2023-07-06T03:58:26.594863Z State Last Changed Time: 2023-07-06T03:58:26.667151Z Last Live Time: 2023-07-06T03:58:28.019050Z ============================================================
get_validation_report 参数
获取解析器或扩展程序的验证报告。
$ chronicle_cli parsers get_validation_report [OPTIONS] PROJECT_ID CUSTOMER_ID
LOG_TYPE VALIDATION_REPORT_ID
[New]Get validation report for a parser/extension
Options:
--parser_id TEXT ID of the parser.
--parserextension_id TEXT ID of the parser extension.
--env [prod|test] Optional: Specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select a region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
示例输出
Fetching Validation report for ParserExtension...
Validation Report:
Verdict: PASS
Stats:
LogEntry Count: 10000
Successfully Normalized Log Count: 10000
Failed Log Count: 0
Invalid Log Count: 0
On Error Count: 153938
Event Count: 10000
Generic Event Count: 0
Event Category:
Valid_event: 10000
Drop Tag:
-
Max Parse Duration: 0.274677769s
Avg Parse Duration: 0.010s
Normalization percent: 100
Generic Event percent: 0
Errors: -
选项
帮助 (-h / --help)
使用 -h 或 --help 选项可查看任意命令的使用情况和说明。
用法示例：
$ chronicle_cli parsers list_parsers -h
Usage: chronicle_cli parsers list_parsers [OPTIONS] PROJECT_ID CUSTOMER_ID LOG_TYPE
[New]List all parsers for a given customer
Options:
-s, --state [ALL|ACTIVE|INACTIVE]
Filter on Parser State.
-f, --file-format [TXT|JSON] Format of the file to be exported.
--export TEXT Export output to specified file path.
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli
/chronicle_credentials.json
--v2 Enable v2 commands.
-h, --help Show this message and exit.
环境 (--env)
您可以通过在命令中传递 --env 标志来选择环境，系统会相应地执行 API 调用。
您可以从以下选项中选择一个环境变量值：prod、test。
如果您未指定此选项，则默认为 prod。
凭据文件（-c 或 --credential_file）
此选项允许指定服务账号的路径
进行身份验证。
如果未指定此选项，则 Google SecOps CLI 会在
默认路径，即 ~/.chronicle_cli（位于主目录下名为 .chronicle_cli 的隐藏目录中）。
用法示例：
$ chronicle_cli parsers list_parsers --credential_file=C:\chronicle_credentials.json
区域 (--region)
您可以在运行命令时传递 --region 标志，从而选择区域。
如需详细了解如何设置默认区域，请参阅设置默认区域。
详细 (--verbose)
通过此选项，您可以输出发出的 HTTP 请求和收到的响应的详细信息。
用法示例：
$ chronicle_cli parsers list_parsers --verbose
导出 (--export)
通过此选项，您可以指定将 list 或 list_errors 命令的输出导出到的文件路径。同时支持相对路径和绝对路径。
用法示例：
$ chronicle_cli parsers list_parsers --export=parser_list
文件格式 (--file-format)
通过此选项，您可以指定使用 list 或 list_errors 命令导出的内容的文件格式。支持两种格式：JSON 和 TXT。如果未通过 --export 选项指定此选项，则系统会默认使用 TXT 格式。
用法示例：
$ chronicle_cli parsers list_parsers --export=parser_list --file-format=JSON
解析器管理用户工作流
Google SecOps CLI 可用于使用以下命令管理 CBN 解析器。 不过，我们建议您使用解析器管理 v2 CLI 命令。
命令
parsers 命令
parsers 命令采用以下参数：
archivedownloadgeneratehistorylistlist_errorsrunstatussubmit
用法语法：
$ chronicle_cli parsers ARGUMENT [OPTIONS]
参数
Google SecOps CLI 中的所有 CBN 解析器管理工作流都是交互式的。当命令需要时，系统会提示您输入选项。
list 参数
如需列出所有解析器的详细信息，请使用以下命令：
$ chronicle_cli parsers list -h
Usage: main parsers list [OPTIONS]
List all parsers of a given customer
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--export TEXT Export output to specified file path.
--file-format [TXT|CSV|JSON] Format of the file to be exported.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
示例输出
Fetching list of parsers...
Parser Details:
Config ID: 1cb402d9-eab2-4f6b-b402-20b1211675ed
Log type: WINDOWS_SYSMON
State: LIVE
SHA256: 7xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7
Author: <user>@test.com
Submit Time: 2022-08-26T09:57:10.644351Z
State Last Changed Time: 2022-08-26T09:58:23.809636Z
Last Live Time: 2022-08-26T09:58:23.809636Z
============================================================
Parser Details:
Config ID: 7f2ae1f5-8f0c-43f9-bb02-299e7c8b9e82
Log type: BOX
State: LIVE
SHA256: 8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7
Author: <user>@test.com
Submit Time: 2022-08-25T07:33:31.026399Z
State Last Changed Time: 2022-08-25T07:33:32.263754Z
Last Live Time: 2022-08-25T07:33:32.263754Z
============================================================
generate 参数
如需为给定的日志类型生成示例日志，请使用以下命令：
$ chronicle_cli parsers generate -h
Usage: main parsers generate [OPTIONS]
Generate sample logs for a given log type
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
该命令会创建三个文件，这些文件的根目录下包含 1 个、10 个和 1,000 个示例日志
目录中。<root>/chronicle_cli/cbn/<log_type>/
示例输出
Enter Start Date (Format: yyyy-mm-ddThh:mm:ssZ): 2022-08-17T10:00:00Z
Enter End Date (Format: yyyy-mm-ddThh:mm:ssZ): 2022-08-23T10:00:00Z
Enter Log Type: WINDOWS_DHCP
Generating sample size: 1...
Generating sample size: 10...
Generating sample size: 1k...
Generated sample data (WINDOWS_DHCP); run this to go there:
cd /usr/local/home/<user>/cbn/windows_dhcp
history 参数
如需获取给定日志类型的所有解析器提交详情的列表，请使用以下命令：
$ chronicle_cli parsers history -h
Usage: main parsers history [OPTIONS]
History retrieves all parsers submissions given a log type
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
示例输出
Enter Log Type: WINDOWS_SYSMON
Fetching history for parser...
Parser History:
Config ID: 8d9f5b1c-4689-4ca3-ae9b-863ce78dd123
Log type: WINDOWS_SYSMON
State: LIVE
SHA256: 7xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7
Author: author@test.com
Submit Time: 2022-08-26T12:37:55.187407Z
State Last Changed Time: 2022-08-26T12:39:12.198587Z
Last Live Time: 2022-08-26T12:39:12.198587Z
============================================================
Parser History:
Config ID: 29bbf14b-2ffb-411a-bb37-911b13437123
Log type: WINDOWS_SYSMON
State: ARCHIVED
SHA256: 8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7
Author: author@test.com
Submit Time: 2022-08-26T12:05:34.421743Z
State Last Changed Time: 2022-08-26T12:39:12.198587Z
Last Live Time: 2022-08-26T12:06:55.495269Z
============================================================
list_errors 参数
如需列出特定时间戳之间的日志类型的错误，请使用以下命令：
$ chronicle_cli parsers list_errors -h
Usage: main parsers list_errors [OPTIONS]
List errors of a log type between specific timestamps
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--export TEXT Export output to specified file path.
--file-format [TXT|CSV|JSON] Format of the file to be exported.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
示例输出
Enter Log Type: CISCO_ASA_FIREWALL
Enter Start Date (Format: yyyy-mm-ddThh:mm:ssZ): 2021-01-16T00:00:00Z
Enter End Date (Format: yyyy-mm-ddThh:mm:ssZ): 2022-08-21T12:00:00Z
Getting parser errors...
Error Details:
Error ID: f9eb72cb-f320-dd5a-a098-00bcaa76a35d
Config ID: N/A
Log type: CISCO_ASA_FIREWALL
Error Time: 2022-08-18T10:57:56.898883208Z
Error Category: CBN_parsers_GENERATED_INVALID_EVENT
Error Message: generic::invalid_argument: diff event timestamp ("seconds:1630106465") and create timestamp ("seconds:1660820265 nanos:202151000"): 8531h36m40.202151s, larger than allowed (4320h0m0s)
Logs:
<190>Aug 27 2020 23:21:05 TEST : %ASA-6-106012: Deny IP from 1.2.3.4 to 5.6.7.8, IP options: Test user
============================================================
Error Details:
Error ID: f9eb72cb-f320-dd5a-a098-00bcaa76a35d
Config ID: N/A
Log type: CISCO_ASA_FIREWALL
Error Time: 2022-08-18T10:57:56.898883208Z
Error Category: CBN_parsers_GENERATED_INVALID_EVENT
Error Message: generic::invalid_argument: diff event timestamp ("seconds:1630106465") and create timestamp ("seconds:1660820265 nanos:202151000"): 8531h36m40.202151s, larger than allowed (4320h0m0s)
Logs:
<190>Aug 27 2020 23:21:05 TEST : %ASA-6-106012: Deny IP from 1.2.3.4 to 5.6.7.8, IP options: Demo user
run 参数
如需根据给定日志验证解析器，请使用以下命令：
$ chronicle_cli parsers run -h
Usage: main parsers run [OPTIONS]
Run the parser against given logs
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
示例输出
Enter path for conf file: /usr/local/home/Desktop/windows_sysmon.conf
Enter path for log file: /usr/local/home/Desktop/windows_sysmon.log
Running Validation…
Runtime: 2.4914s
submit 参数
如需提交新的解析器，请使用以下命令：
$ chronicle_cli parsers submit -h
Usage: main parsers submit [OPTIONS]
Submit new parser
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
示例输出
Enter Log type: CISCO_ASA_FIREWALL
Enter Config file path: /usr/local/Desktop/windows_sysmon.conf
Enter author: test
Submitting parser...
Submitted Parser Details:
Config ID: 9ba20930-9733-4fcd-badf-18fedb9f8123
Log type: CISCO_ASA_FIREWALL
State: NEW
SHA256: 7xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7
Author: test
Submit Time: 2022-08-30T06:49:54.005119Z
State Last Changed Time: 2022-08-30T06:49:54.005119Z
Parser submitted successfully. To get status of the parser, run this command using following Config ID - 9ba20930-9733-4fcd-badf-18fedb9f8123:
chronicle_cli parsers status
status 参数
如需获取已提交解析器的状态，请使用以下命令：
$ chronicle_cli parsers status -h
Usage: main parsers status [OPTIONS]
Get status of a submitted parser
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
示例输出
Enter Config ID: 1cb402d9-eab2-4f6b-b402-20b1211675ed
Getting parser...
Parser Details:
Config ID: 1cb402d9-eab2-4f6b-b402-20b1211675ed
Log type: WINDOWS_SYSMON
State: ARCHIVED
SHA256: 79ac67c15ffb047a152be2fb2a3391cbe18b2d183e9e6a402eb2fe53a6666b17
Author: test
Submit Time: 2022-08-26T09:57:10.644351Z
State Last Changed Time: 2022-08-26T09:58:23.809636Z
Last Live Time: 2022-08-26T09:58:23.809636Z
archive 参数
如需归档现有解析器，请使用以下命令：
$ chronicle_cli parsers archive -h
Usage: main parsers archive [OPTIONS]
Archives a parser given the config ID.
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
示例输出
Enter Config ID: 1cb402d9-eab2-4f6b-b402-20b121167123
Archiving parser...
Parser archived Successfully.
Parser Details:
Config ID: 1cb402d9-eab2-4f6b-b402-20b121167123
Log type: WINDOWS_SYSMON
State: ARCHIVED
SHA256: 7xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7
Author: test
Submit Time: 2022-08-26T09:57:10.644351Z
State Last Changed Time: 2022-08-26T09:58:23.809636Z
Last Live Time: 2022-08-26T09:58:23.809636Z
download 参数
如需下载给定日志类型或配置 ID 的配置 (.conf) 文件，请执行以下操作：
请使用以下命令：
$ chronicle_cli parsers download -h
Usage: main parsers download [OPTIONS]
Download parser code by given Config ID or Log type.
Options:
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
示例输出
- 使用配置 ID。
Note: If you want to download parser by log type then skip the config ID.
Enter config ID: 9d1474ab-eff2-4855-ba57-4f0c458e3ac2
Downloading parser...
Writing parser to: CISCO_ASA_FIREWALL_20220825131911.conf
- 使用日志类型。
Note: If you want to download parser by log type then skip the config ID.
Enter config ID:
Enter Log Type: CISCO_ASA_FIREWALL
Downloading parser...
Writing parser to: CISCO_ASA_FIREWALL_20220825132011.conf
选项
帮助 (-h / --help)
使用 -h 或 --help 选项可查看任意命令的使用情况和说明。
用法示例：
$ chronicle_cli parsers list -h
Usage: main parsers list [OPTIONS]
List all parsers of a given customer
Options:
-f, --file-format [TXT|JSON] Format of the file to be exported.
--export TEXT Export output to specified file path.
--env [prod|test] Optionally specify the environment for API
calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/home/<user>/.chronicle_cli/chro
nicle_credentials.json
-h, --help Show this message and exit.
环境 (--env)
您可以通过在命令中传递 --env 标志来选择环境，系统会相应地执行 API 调用。
您可以从以下选项中选择一个环境变量值：prod、test。
如果您未指定此选项，则系统会默认设置为 prod。
凭据文件（-c 或 --credential_file）
通过此选项，您可以指定要用于用户身份验证的服务账号凭据的路径。如果未指定此选项，Google SecOps CLI 会在默认路径（即 ~/.chronicle_cli，位于主目录下名为 .chronicle_cli 的隐藏目录中）中查找凭据。
用法示例：
$ chronicle_cli parsers list --credential_file=C:\chronicle_credentials.json
区域 (--region)
您可以在运行命令时传递 --region 标志，从而选择区域。
如需详细了解如何设置默认区域，请参阅设置默认区域。
详细 (--verbose)
通过此选项，您可以输出发出的 HTTP 请求和收到的响应的详细信息。
用法示例：
$ chronicle_cli parsers list --verbose
导出 (--export)
通过此选项，您可以指定 list 或
list_errors 命令将导出。同时支持相对路径和绝对路径。
用法示例：
$ chronicle_cli parsers list --export=parsers_list
文件格式 (--file-format)
通过此选项，您可以指定使用
list 或 list_errors 命令。支持以下三种格式：JSON 和 TXT。
如果未使用 --export 选项指定此选项，则系统会默认使用 TXT 格式。
用法示例：
$ chronicle_cli parsers list --export=parsers_list --file-format=JSON
问题排查
CBN 解析器管理错误代码
本部分介绍了针对从 API 响应收到的不同类型的响应代码在控制台中显示的输出。
请参阅下表，查看每个命令的输出：
| 响应代码 | 命令 | 控制台输出 |
| 除 200 以外的任何响应代码 | {command}[archive, download, generate, history, list_errors, run, status, list, submit] |
{command}解析器时出错。响应代码： {status code}错误：{error message} |
转发器管理用户工作流程
Google SecOps CLI 可用于使用以下命令管理转发器及其关联的收集器：
命令
forwarders 命令
forwarders 命令接受以下参数：
createupdategetlistdeletegenerate_filescollectors
用法语法：
$ chronicle_cli forwarders ARGUMENT [OPTIONS]
collectors 命令
collectors 命令采用以下参数：
createupdategetlistdelete
用法语法：
$ chronicle_cli forwarders collectors ARGUMENT [OPTIONS]
参数
Google SecOps CLI 中的所有转发器管理用户工作流都 可交互。如有需要，系统会提示您提供相关选项。
create 参数
如需创建新的转发器并为其配置收集器，请使用以下命令：
$ chronicle_cli forwarders create --help
Usage: main forwarders create [OPTIONS]
Create a Forwarder
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
$ chronicle_cli forwarders create
================================================================================
Press Enter if you want to use the default value mentioned besides field description in [] brackets.
================================================================================
(*) Forwarder Display Name : test_display_name
========================================
======== Forwarder Configuration =======
========================================
Upload Compression (Determines if uploaded data will be compressed) [Y/n]: y
Do you want to proceed with Forwarder Metadata? [y/N]: y
========================================
========== Forwarder Metadata ==========
========================================
Asset Namespace: test_namespace
========================================
=========== Forwarder Labels ===========
========================================
Labels (The ingestion metadata labels in 'key:value' format to apply to all logs ingested through this forwarder, as well as the resulting normalized data.)
Enter/Paste your content. On a new line, press Ctrl-D (Linux) / [Ctrl-Z + Enter (Windows)] to save it:
key1:value1
key2:value2
Do you want to proceed with Forwarder Regex Filters? [y/N]: y
========================================
======= Forwarder Regex Filters =======
========================================
Filter Description (Describes what is being filtered and why): desc1
Filter Regexp (The regular expression used to match against each incoming line): .*
Filter Behavior (Filter behavior to apply when a match is found)
Choose:
1. allow
2. block
: 1
You have selected allow
Do you want to add more Forwarder Regex Filters [y/N]: y
Filter Description (Describes what is being filtered and why): desc2
Filter Regexp (The regular expression used to match against each incoming line): .*
Filter Behavior (Filter behavior to apply when a match is found)
Choose:
1. allow
2. block
: 2
You have selected block
Do you want to add more Forwarder Regex Filters [y/N]: n
Do you want to proceed with Server Settings? [y/N]: y
========================================
=========== Server Settings ===========
========================================
Server State (Server State for Collector)
Choose:
1. active
2. suspended
: 1
You have selected active
Graceful Timeout (Number of seconds after which the forwarder returns a bad readiness/health check and still accepts new connections) [15]:
Drain timeout (Number of seconds after which the forwarder waits for active connections to successfully close on their own before being closed by the server) [10]:
Do you want to proceed with HTTP-specific server settings? [y/N]: y
========================================
==== HTTP-specific server settings ====
========================================
Host (IP address, or hostname that can be resolved to IP addresses, that the server should listen on) [0.0.0.0]: 10.0.14.132
Port (Port number that the HTTP server listens on for health checks from the load balancer) [8080]: 8000
Read Timeout (Maximum amount of time allowed to read the entire request, both the header and the body) [3]:
Read Header Timeout (Maximum amount of time allowed to read request headers) [3]:
Write Timeout (Maximum amount of time allowed to send a response) [3]:
Idle Timeout (Maximum amount of time (in seconds) to wait for the next request when idle connections are enabled) [3]:
Do you want to proceed with Route Settings? [y/N]: y
========================================
============ Route Settings ============
========================================
Available Status Code (Status code returned when a liveness check is received and the forwarder is available) [204]: 200
Ready Status Code (Status code returned when it is ready to accept traffic) [204]: 200
Unready Status Code (Status code returned when it is not ready to accept traffic) [503]: 500
Preview changes:
- Press Up/b or Down/z keys to paginate.
- To switch case-sensitivity, press '-i' and press enter. By default, search
is case-sensitive.
- To search for specific field, press '/' key, enter text and press enter.
- Press 'q' to quit and confirm preview changes.
- Press `h` for all the available options to navigate the list.
=============================================================================
Config:
Metadata:
Asset namespace: test_namespace
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
- behavior: ALLOW
description: desc1
regexp: .*
- behavior: BLOCK
description: desc2
regexp: .*
Server settings:
Drain timeout: 10
Graceful timeout: 15
Http settings:
Host: 10.0.14.132
Idle timeout: 3
Port: 8000
Read header timeout: 3
Read timeout: 3
Do you want to create forwarder with this configuration [y/N]: y
Creating forwarder...
Forwarder created successfully with Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Would you like to configure collectors for this forwarder? [y/N]: y
(*) Collector Display Name: collector_1
========================================
======== Collector Configuration ======
========================================
(*) Collector Log Type (Type of logs collected): WINDOWS_DNS
Do you want to proceed with Collector Metadata? [y/N]: y
========================================
========== Collector Metadata ==========
========================================
Asset Namespace: test_namespace
========================================
=========== Forwarder Labels ===========
========================================
Labels (The ingestion metadata labels in 'key:value' format to apply to all logs ingested through this forwarder, as well as the resulting normalized data.)
Enter/Paste your content. On a new line, press Ctrl-D (Linux) / [Ctrl-Z + Enter (Windows)] to save it:
key1:value1
key2:value2
Do you want to proceed with Collector Regex Filters? [y/N]: y
========================================
======= Collector Regex Filters =======
========================================
Filter Description (Describes what is being filtered and why): desc1
Filter Regexp (The regular expression used to match against each incoming line): .*
Filter Behavior (Filter behavior to apply when a match is found)
Choose:
1. allow
2. block
: 1
You have selected allow
Do you want to add more Collector Regex Filters [y/N]: n
Do you want to proceed with Collector Disk Buffer? [y/N]: y
========================================
======== Collector Disk Buffer ========
========================================
Disk Buffer State (Disk buffering state for collector)
Choose:
1. active
2. suspended
: 1
You have selected active
Directory Path (Directory path for files written): path/to/file.txt
Max File Buffer Bytes (Maximum buffered file size): 45
Maximum Seconds per Batch (Maximum number of seconds between forwarder batch uploads) [10]:
Maximum Bytes per Batch (Maximum number of bytes queued before forwarder batch upload) [1048576]:
========================================
===== Configure Ingestion Settings =====
========================================
Choose:
1. File Settings
2. Kafka Settings
3. Pcap Settings
4. Splunk Settings
5. Syslog Settings
: 1
File Path (Path of file to monitor): path/to/file.txt
Preview changes:
- Press Up/b or Down/z keys to paginate.
- To switch case-sensitivity, press '-i' and press enter. By default, search
is case-sensitive.
- To search for specific field, press '/' key, enter text and press enter.
- Press 'q' to quit and confirm preview changes.
- Press `h` for all the available options to navigate the list.
=============================================================================
Config:
Disk buffer:
Directory path: path/to/file.txt
Max file buffer bytes: 45
State: ACTIVE
File settings:
File path: path/to/file.txt
Log type: WINDOWS_DNS
Max bytes per batch: 1048576
Max seconds per batch: 10
Metadata:
Asset namespace: test_namespace
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
Behavior: ALLOW
Description: desc1
Regexp: .*
Display name: collector_1
Do you want to create collector with this configuration [y/N]: y
Creating collector...
Collector created successfully with Collector ID: 1f72f9ab-3ae3-4c5f-955e-86c982587937
Would you like to add more collectors? [y/N]: n
如果转发器创建失败，但您输入的转发器 ID 与转发器相同，那么您是 提示重试失败的转发器或重新启动该进程。 如果您输入的转发器 ID 与故障转发器 ID 不匹配， 则系统不会提示您重试，并继续创建转发器的正常过程。
示例输出
...
Creating forwarder...
Error occurred while creating forwarder.
Response Code: 500.
Error: ZERO_APP::1: create forwarder due to validation errors in request: generic::invalid_argument: filter's description is not specified
$ chronicle_cli forwarders create
Looks like there was a failed create/update attempt for test.
Would you like to retry?
(*) Forwarder Display Name [test]:
Do you want to create forwarder with this configuration [y/N]: y
Creating forwarder...
Forwarder created successfully with Forwarder ID: ab7af569-d957-44a3-99a8-aa70ffdc6458
Would you like to configure collectors for this forwarder? [y/N]: n
get 参数
如需获取现有转发器和相应收集器的详细信息，请使用以下命令：
$ chronicle_cli forwarders get --help
Usage: main forwarders get [OPTIONS]
Get forwarder details using Forwarder ID
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
您必须输入转发商 ID 才能获取转发商详细信息。
$ chronicle_cli forwarders get
Enter Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Fetching forwarder and its all associated collectors...
Forwarder Details:
ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Display name: test_display_name
State: ACTIVE
Config:
Upload compression: true
Metadata:
Asset namespace: test_namespace
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
- description: desc1
regexp: .*
behavior: ALLOW
- description: desc2
regexp: .*
behavior: BLOCK
Server settings:
Graceful timeout: 15
Drain timeout: 10
Http settings:
Port: 8000
Host: 10.0.14.132
Read timeout: 3
Read header timeout: 3
Write timeout: 3
Idle timeout: 3
Route settings:
Available status code: 200
Ready status code: 200
Unready status code: 500
State: ACTIVE
Collectors:
Collector [1f72f9ab-3ae3-4c5f-955e-86c982587937]:
Display name: collector_1
State: ACTIVE
Config:
Log type: WINDOWS_DNS
Metadata:
Asset namespace: test_namespace
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
- description: desc1
regexp: .*
behavior: ALLOW
Disk buffer:
State: ACTIVE
Directory path: path/to/file.txt
Max file buffer bytes: '45'
Max seconds per batch: 10
Max bytes per batch: '1048576'
File settings:
File path: path/to/file.txt
================================================================================
list 参数
如需显示所有转发器和相应收集器的列表，请使用以下命令：
$ chronicle_cli forwarders list --help
Usage: main forwarders list [OPTIONS]
List all forwarders
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
--export TEXT Export output to specified file path
--file-format [TXT|CSV|JSON] Format of the file to be exported
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
命令用于获取所有转发器和收集器的详细信息。
示例输出
$ chronicle_cli forwarders list
Fetching list of forwarders...
Forwarder Details:
ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Display name: test_display_name
State: ACTIVE
Config:
Upload compression: true
Metadata:
Asset namespace: test_namespace
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
- description: desc1
regexp: .*
behavior: ALLOW
- description: desc2
regexp: .*
behavior: BLOCK
Server settings:
Graceful timeout: 15
Drain timeout: 10
Http settings:
Port: 8000
Host: 10.0.14.132
Read timeout: 3
Read header timeout: 3
Write timeout: 3
Idle timeout: 3
Route settings:
Available status code: 200
Ready status code: 200
Unready status code: 500
State: ACTIVE
Collectors:
Collector [1f72f9ab-3ae3-4c5f-955e-86c982587937]:
Display name: collector_1
State: ACTIVE
Config:
Log type: WINDOWS_DNS
Metadata:
Asset namespace: test_namespace
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
- description: desc1
regexp: .*
behavior: ALLOW
Disk buffer:
State: ACTIVE
Directory path: path/to/file.txt
Max file buffer bytes: '45'
Max seconds per batch: 10
Max bytes per batch: '1048576'
File settings:
File path: path/to/file.txt
================================================================================
Forwarder Details:
ID: ddcca884-cdc6-4ac2-ad30-05a28e6cf35a
Display name: test
State: ACTIVE
Config:
Upload compression: true
Metadata:
Asset namespace: test
Labels:
- key: k1
value: v2
Regex filters:
- description: hh
regexp: hh
behavior: ALLOW
- description: gg
regexp: gg
behavior: BLOCK
Server settings:
Graceful timeout: 15
Drain timeout: 10
Http settings:
Port: 8080
Host: 0.0.0.0
Read timeout: 3
Read header timeout: 3
Write timeout: 3
Idle timeout: 3
Route settings:
Available status code: 204
Ready status code: 204
Unready status code: 503
State: ACTIVE
Collectors:
Message: No collectors found for this forwarder.
================================================================================
如果您想要导出数据，则可以指定要导出的文件的绝对/相对路径以及文件格式 (CSV/TXT/JSON)。默认文件格式为 CSV。
示例输出
$ chronicle_cli forwarders list --export=$HOME/listforwarder --file-format=JSON
Fetching list of forwarders...
Forwarder Details:
ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Display name: test_display_name
State: ACTIVE
Config:
Upload compression: true
Metadata:
Asset namespace: test_namespace
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
- description: desc1
regexp: .*
behavior: ALLOW
- description: desc2
regexp: .*
behavior: BLOCK
Server settings:
Graceful timeout: 15
Drain timeout: 10
Http settings:
Port: 8000
Host: 10.0.14.132
Read timeout: 3
Read header timeout: 3
Write timeout: 3
Idle timeout: 3
Route settings:
Available status code: 200
Ready status code: 200
Unready status code: 500
State: ACTIVE
Collectors:
Collector [1f72f9ab-3ae3-4c5f-955e-86c982587937]:
Display name: collector_1
State: ACTIVE
Config:
Log type: WINDOWS_DNS
Metadata:
Asset namespace: test_namespace
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
- description: desc1
regexp: .*
behavior: ALLOW
Disk buffer:
State: ACTIVE
Directory path: path/to/file.txt
Max file buffer bytes: '45'
Max seconds per batch: 10
Max bytes per batch: '1048576'
File settings:
File path: path/to/file.txt
================================================================================
Forwarder Details:
ID: ddcca884-cdc6-4ac2-ad30-05a28e6cf35a
Display name: test
State: ACTIVE
Config:
Upload compression: true
Metadata:
Asset namespace: test
Labels:
- key: k1
value: v2
Regex filters:
- description: hh
regexp: hh
behavior: ALLOW
- description: gg
regexp: gg
behavior: BLOCK
Server settings:
Graceful timeout: 15
Drain timeout: 10
Http settings:
Port: 8080
Host: 0.0.0.0
Read timeout: 3
Read header timeout: 3
Write timeout: 3
Idle timeout: 3
Route settings:
Available status code: 204
Ready status code: 204
Unready status code: 503
State: ACTIVE
Collectors:
Message: No collectors found for this forwarder.
================================================================================
Forwarders list details exported successfully to: /usr/local/google/home/<user>/listforwarder.json
update 参数
如需更新现有转发器，请使用以下命令：
$ chronicle_cli forwarders update --help
Usage: main forwarders update [OPTIONS]
Update a forwarder using forwarder ID.
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
运行该命令后，请再次输入转发器 ID 和所有字段值。 按 Enter 键即可重复使用旧值。
示例输出
$ chronicle_cli forwarders update
Enter Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Press Enter if you don't want to update.
(*) Forwarder Display Name [test_display_name]:
========================================
======== Forwarder Configuration =======
========================================
Upload Compression (Determines if uploaded data will be compressed) [Y/n]: y
Do you want to proceed with Forwarder Metadata? [y/N]: y
========================================
========== Forwarder Metadata ==========
========================================
Asset Namespace [test_namespace]:
========================================
=========== Forwarder Labels ===========
========================================
Labels (The ingestion metadata labels in 'key:value' format to apply to all logs ingested through this forwarder, as well as the resulting normalized data.)
Enter/Paste your content. On a new line, press Ctrl-D (Linux) / [Ctrl-Z + Enter (Windows)] to save it:
[[{'key': 'key1', 'value': 'value1'}, {'key': 'key2', 'value': 'value2'}]]
Do you want to proceed with Forwarder Regex Filters? [y/N]: n
Do you want to proceed with Server Settings? [y/N]: n
Do you want to update forwarder with this configuration? [y/N]: y
Updating forwarder...
Forwarder updated successfully with Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
如果转发器更新失败，并且您输入了相同的转发器，系统会显示提示，以便您重试失败的转发器或重启流程。如果您输入的是 与故障转发器 ID 不匹配，则不会显示重试选项，并且 更新转发器的正常过程会继续进行。重试机制让您可以 更改上一次互动失败的尝试中提供的选项值 。按 Enter 键即可为转发器更新流程中的选项重复使用相同的值。
delete 参数
您可以使用此参数通过转发器 ID 删除转发器。在执行时，它会要求删除 Feed 的 ID。 如需删除现有转发器，请使用以下命令：
chronicle_cli forwarders delete --help
Usage: main forwarders delete [OPTIONS]
Delete a forwarder using Forwarder ID
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
$ chronicle_cli forwarders delete
Enter Forwarder ID: 0593ba21-a1c7-4279-b429-bc8df959bd59
Deleting forwarder and all its associated collectors...
Forwarder (ID: 0593ba21-a1c7-4279-b429-bc8df959bd59) deleted successfully with all its associated collectors.
generate_files 参数
使用此参数生成包含使用转发器 ID 的转发器信息的文件。
如需生成转发器文件，请使用以下命令：
$ chronicle_cli forwarders generate_files -h
Usage: main forwarders generate_files [OPTIONS]
Generate forwarder configuration files using Forwarder ID
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-f, --file-path TEXT Download generated forwarder files to the
specified path.
-h, --help Show this message and exit.
示例输出
$ chronicle_cli forwarders generate_files --file-path=$HOME/GenerateForwarderFile
Enter Forwarder ID: 0768220e-8af6-4ef7-a1dd-73e33963b444
Generating forwarder files ...
Forwarder files generated successfully.
Configuration file: /usr/local/google/home/<user>/GenerateForwarderFile_forwarder.conf
Auth file: /usr/local/google/home/<user>/GenerateForwarderFile_forwarder_auth.conf
收集器子命令
create 参数
使用以下命令为给定转发器配置新的收集器。
$ chronicle_cli forwarders collectors create --help
Usage: main forwarders collectors create [OPTIONS]
Create a collector.
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
$ chronicle_cli forwarders collectors create
================================================================================
Press Enter if you want to use the default value mentioned besides field description in [] brackets.
================================================================================
Enter Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
(*) Collector Display Name: collector_4
========================================
======== Collector Configuration ======
========================================
(*) Collector Log Type (Type of logs collected): WINDOWS_DNS
Do you want to proceed with Collector Metadata? [y/N]: y
========================================
========== Collector Metadata ==========
========================================
Asset Namespace: test_namespace
========================================
=========== Forwarder Labels ===========
========================================
Labels (The ingestion metadata labels in 'key:value' format to apply to all logs ingested through this forwarder, as well as the resulting normalized data.)
Enter/Paste your content. On a new line, press Ctrl-D (Linux) / [Ctrl-Z + Enter (Windows)] to save it:
key1:value1
key2:value2
Do you want to proceed with Collector Regex Filters? [y/N]: y
========================================
======= Collector Regex Filters =======
========================================
Filter Description (Describes what is being filtered and why): desc1
Filter Regexp (The regular expression used to match against each incoming line): .*
Filter Behavior (Filter behavior to apply when a match is found)
Choose:
1. allow
2. block
: 1
You have selected allow
Do you want to add more Collector Regex Filters? [y/N]: n
Do you want to proceed with Collector Disk Buffer? [y/N]: n
Maximum Seconds per Batch (Maximum number of seconds between forwarder batch uploads) [10]:
Maximum Bytes per Batch (Maximum number of bytes queued before forwarder batch upload) [1048576]:
========================================
===== Configure Ingestion Settings =====
========================================
Choose:
1. File Settings
2. Kafka Settings
3. Pcap Settings
4. Splunk Settings
5. Syslog Settings
File Path (Path of file to monitor): path/to/file.txt
Preview changes:
- Press Up/b or Down/z keys to paginate.
- To switch case-sensitivity, press '-i' and press enter. By default, search
is case-sensitive.
- To search for specific field, press '/' key, enter text and press enter.
- Press 'q' to quit and confirm preview changes.
- Press `h` for all the available options to navigate the list.
=============================================================================
Config:
File settings:
File path: path/to/file.txt
Log type: WINDOWS_DNS
Max bytes per batch: 1048576
Max seconds per batch: 10
Metadata:
Asset namespace: test_namespace
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
Behavior: ALLOW
Description: desc1
Regexp: .*
Display name: collector_4
Do you want to create collector with this configuration? [y/N]: y
Creating collector...
Collector created successfully with Collector ID: 3a74b289-ccb4-4cee-9713-611a3362f48f
如果收集器创建失败，并且您输入了相同的收款方 ID，则系统会在提示 显示以重试失败的收集器或重新启动该进程。如果您输入的是收款方 ID 与失败的收款方 ID 不匹配，则重试选项不会 收集器的正常更新过程也将继续。
示例输出
$ chronicle_cli forwarders collectors create
Enter Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Looks like there was a failed create/update attempt for test_display.
Would you like to retry?
(*) Collector Display Name [test_display]:
========================================
======== Collector Configuration ======
========================================
(*) Collector Log Type (Type of logs collected) [WINDOWS_DNS]:
Do you want to proceed with Collector Metadata? [y/N]: y
========================================
========== Collector Metadata ==========
========================================
Asset Namespace [test]:
========================================
=========== Forwarder Labels ===========
========================================
Labels (The ingestion metadata labels in 'key:value' format to apply to all logs ingested through this forwarder, as well as the resulting normalized data.)
Enter/Paste your content. On a new line, press Ctrl-D (Linux) / [Ctrl-Z + Enter (Windows)] to save it:
[[{'key': 'k1', 'value': 'v1'}]]
Do you want to proceed with Collector Regex Filters? [y/N]: y
========================================
======= Collector Regex Filters =======
========================================
Filter Description (Describes what is being filtered and why)[old_desc]: desc2
Filter Regexp (The regular expression used to match against each incoming line) [.*]:
Filter Behavior (Filter behavior to apply when a match is found)
Choose:
1. allow
2. block
You have selected allow
Do you want to add more Collector Regex Filters? [y/N]: n
Do you want to proceed with Collector Disk Buffer? [y/N]: n
Maximum Seconds per Batch (Maximum number of seconds between forwarder batch uploads) [10]:
Maximum Bytes per Batch (Maximum number of bytes queued before forwarder batch upload) [1048576]:
========================================
===== Configure Ingestion Settings =====
========================================
Choose:
1. File Settings
2. Kafka Settings
3. Pcap Settings
4. Splunk Settings
5. Syslog Settings
: 1
File Path (Path of file to monitor) [path/to/file.txt]: path/to/file.txt
Preview changes:
- Press Up/b or Down/z keys to paginate.
- To switch case-sensitivity, press '-i' and press enter. By default, search
is case-sensitive.
- To search for specific field, press '/' key, enter text and press enter.
- Press 'q' to quit and confirm preview changes.
- Press `h` for all the available options to navigate the list.
=============================================================================
Config:
File settings:
File path: path/to/file.txt
Log type: WINDOWS_DNS
Max bytes per batch: 1048576
Max seconds per batch: 10
Metadata:
Asset namespace: test
Labels:
- key: k1
value: v1
Regex filters:
Behavior: ALLOW
Description: disc2
Regexp: .*
Display name: test_display
Do you want to create collector with this configuration? [y/N]: y
Creating collector...
Collector created successfully with Collector ID: b50a6b41-5476-41ee-ba7c-ce529ecffa62
get 参数
如需获取现有收集器的详细信息，请使用以下命令：
$ chronicle_cli forwarders collectors get --help
Usage: main forwarders collectors get [OPTIONS]
Get a collector using collector ID.
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
您必须以交互方式输入收款方 ID 才能获取收款方详细信息。
$ chronicle_cli forwarders collectors get
Enter Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Enter Collector ID: 3a74b289-ccb4-4cee-9713-611a3362f48f
Fetching collector details...
Collector Details:
ID: 3a74b289-ccb4-4cee-9713-611a3362f48f
Display name: collector_4
State: ACTIVE
Config:
Log type: WINDOWS_DNS
Metadata:
Asset namespace: test_namespace
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
- description: desc1
regexp: .*
behavior: ALLOW
- description: desc2
regexp: .*
behavior: BLOCK
Max seconds per batch: 10
Max bytes per batch: '1048576'
File settings:
File path: path/to/file.txt
list 参数
如需显示所有收集器的列表，请使用以下命令：
chronicle_cli forwarders collectors list --help
Usage: main forwarders collectors list [OPTIONS]
List all collectors.
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
--export TEXT Export output to specified file path.
--file-format [TXT|CSV|JSON] Format of the file to be exported.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
$ chronicle_cli forwarders collectors list
Enter Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Collector Details:
ID: 153e4077-cd49-4ce5-87aa-254d239b9dda
Display name: collector_2
State: ACTIVE
Config:
Log type: WINDOWS_DNS
Metadata:
Asset namespace: test
Labels:
- key: key1
value: value1
- key: key2
value: value2
Regex filters:
- description: desc1
regexp: .*
behavior: ALLOW
Disk buffer:
State: ACTIVE
Directory path: path/to/dir
Max file buffer bytes: '209'
Max seconds per batch: 10
Max bytes per batch: '1048576'
File settings:
File path: path/to/file.txt
================================================================================
Collector Details:
ID: b50a6b41-5476-41ee-ba7c-ce529ecffa62
Display name: test_display
State: ACTIVE
Config:
Log type: WINDOWS_DNS
Metadata:
Asset namespace: test
Labels:
- key: k1
value: v1
Regex filters:
- description: disc2
regexp: .*
behavior: ALLOW
- description: test
regexp: test
behavior: BLOCK
Disk buffer:
State: ACTIVE
Directory path: test
Max file buffer bytes: '55'
Max seconds per batch: 5
Max bytes per batch: '556676'
Syslog settings:
Protocol: TCP
Address: 1.2.3.4
Port: 3456
Buffer size: '65536'
Connection timeout: 60
Tls settings:
Certificate: test
Certificate key: test
Minimum tls version: '56'
Insecure skip verify: true
================================================================================
update 参数
如需更新现有收集器，请使用以下命令：
$ chronicle_cli forwarders collectors update --help
Usage: main forwarders collectors update [OPTIONS]
Update a collector using collector ID.
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
$ chronicle_cli forwarders collectors update
Enter Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Enter Collector ID: 3a74b289-ccb4-4cee-9713-611a3362f48f
(*) Collector Display Name [collector_4]:
========================================
======== Collector Configuration ======
========================================
(*) Collector Log Type (Type of logs collected) [WINDOWS_DNS]:
Do you want to proceed with Collector Metadata? [y/N]: y
========================================
========== Collector Metadata ==========
========================================
Asset Namespace [test_namespace]:
========================================
=========== Forwarder Labels ===========
========================================
Labels (The ingestion metadata labels in 'key:value' format to apply to all logs ingested through this forwarder, as well as the resulting normalized data.)
Enter/Paste your content. On a new line, press Ctrl-D (Linux) / [Ctrl-Z + Enter (Windows)] to save it:
[{'key1':'value1'},{'key2':'value2'}]
Do you want to proceed with Collector Regex Filters? [y/N]: y
========================================
======= Collector Regex Filters =======
========================================
Filter Description (Describes what is being filtered and why)[old_desc]: desc1
Filter Regexp (The regular expression used to match against each incoming line)[.*]: .*
Filter Behavior (Filter behavior to apply when a match is found)
Choose:
1. allow
2. block
You have selected allow
Do you want to add more Collector Regex Filters? [y/N]: y
Filter Description (Describes what is being filtered and why): desc2
Filter Regexp (The regular expression used to match against each incoming line): .*
Filter Behavior (Filter behavior to apply when a match is found)
Choose:
1. allow
2. block
: 2
You have selected block
Do you want to add more Collector Regex Filters? [y/N]: n
Do you want to proceed with Collector Disk Buffer? [y/N]: n
Maximum Seconds per Batch (Maximum number of seconds between forwarder batch uploads) [10]:
Maximum Bytes per Batch (Maximum number of bytes queued before forwarder batch upload) [1048576]:
========================================
===== Configure Ingestion Settings =====
========================================
Choose:
1. File Settings
2. Kafka Settings
3. Pcap Settings
4. Splunk Settings
5. Syslog Settings
File Path (Path of file to monitor) [path/to/file.txt]: path/to/file.txt
Do you want to update collector with this configuration? [y/N]: y
Updating collector...
Collector updated successfully with Collector ID: 3a74b289-ccb4-4cee-9713-611a3362f48f
如果收集器更新失败，并输入了相同的收款方 ID，系统会显示提示 重试失败的收集器或重启进程。如果您输入的是收款方 ID 与失败的收款方 ID 不匹配，则不会显示重试选项， 更新收集器的正常过程会继续进行。重试机制让您可以 更改上一次互动失败的尝试中提供的选项值 。按 Enter 键即可为收集器更新流程中的选项重复使用相同的值。
...
Updating collector...
Do you want to update collector with this configuration? [y/N]: y
Error occurred while updating collector.
Response Code: 400.
Error: generic::invalid_argument: update collector (id: 3a74b289-ccb4-4cee-9713-611a3362f48f) for forwarder (id: a7e59660-959b-44e7-aa7e-baec820d01f4) for customer (id: ed19f037-2354-43df-bfbf-350362b45844): validation errors in request: generic::invalid_argument: filter's description is not specified: invalid argument
$ chronicle_cli forwarders collectors update
Enter Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Enter Collector ID: 3a74b289-ccb4-4cee-9713-611a3362f48f
Looks like there was a failed create/update attempt for collector_4.
Would you like to retry?
(*) Collector Display Name [collector_4]:
========================================
======== Collector Configuration ======
========================================
(*) Collector Log Type (Type of logs collected) [WINDOWS_DNS]:
Do you want to proceed with Collector Metadata? [y/N]: n
Do you want to proceed with Collector Regex Filters? [y/N]: y
========================================
======= Collector Regex Filters =======
========================================
Filter Description (Describes what is being filtered and why)[old_desc]: desc1
Filter Regexp (The regular expression used to match against each incoming line) [.*]:
Filter Behavior (Filter behavior to apply when a match is found)
Choose:
1. allow
2. block
You have selected allow
Do you want to add more Collector Regex Filters? [y/N]: n
Do you want to proceed with Collector Disk Buffer? [y/N]: n
Maximum Seconds per Batch (Maximum number of seconds between forwarder batch uploads) [10]:
Maximum Bytes per Batch (Maximum number of bytes queued before forwarder batch upload) [1048576]:
========================================
===== Configure Ingestion Settings =====
========================================
Choose:
1. File Settings
2. Kafka Settings
3. Pcap Settings
4. Splunk Settings
5. Syslog Settings
[1]:
File Path (Path of file to monitor) [path/to/file.txt]:
Do you want to update collector with this configuration? [y/N]: y
Updating collector...
Collector updated successfully with Collector ID: 3a74b289-ccb4-4cee-9713-611a3362f48f
delete 参数
使用此参数可通过收款方 ID 删除收款方。在执行时，它会要求删除收集器的 ID。
如需删除现有收集器，请使用以下命令：
$ chronicle_cli forwarders collectors delete --help
Usage: main forwarders collectors delete [OPTIONS]
Delete a collector using collector ID.
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
示例输出
$ chronicle_cli forwarders collectors delete
Enter Forwarder ID: a7e59660-959b-44e7-aa7e-baec820d01f4
Enter Collector ID: 3a74b289-ccb4-4cee-9713-611a3362f48f
Collector (ID: 3a74b289-ccb4-4cee-9713-611a3362f48f) deleted successfully.
选项
帮助 (-h / --help)
使用 -h 或 --help 选项可查看任何命令/选项的用法/说明。
用法示例
$ chronicle_cli forwarders list -h
Usage: main forwarders list [OPTIONS]
List all forwarders
Options:
--url TEXT Base URL to be used for API calls.
--region [ASIA-NORTHEAST1|ASIA-SOUTH1|ASIA-SOUTHEAST1|AUSTRALIA-SOUTHEAST1|EUROPE|EUROPE-WEST2|EUROPE-WEST3|EUROPE-WEST6|EUROPE-WEST12|ME-CENTRAL1|ME-CENTRAL2|ME-WEST1|NORTHAMERICA-NORTHEAST2|US]
Select region.
--verbose Prints verbose output to the console.
--export TEXT Export output to specified file path.
--file-format [TXT|CSV|JSON] Format of the file to be exported.
-c, --credential_file TEXT Path of Service Account JSON. Default: /usr/
local/google/home/<user>/.chronicle_cl
i/chronicle_credentials.json
-h, --help Show this message and exit.
凭据路径（-c 或 --credential-path）
通过此选项，您可以指定要用于用户身份验证的服务账号凭据的路径。如果未指定此选项，则 Google SecOps CLI 会在默认路径（即 ~/.chronicle_cli，位于主目录下名为 .chronicle_cli 的隐藏目录中）中查找凭据。
用法示例
$ chronicle_cli forwarders list --credential-path=C:\chronicle_credentials.json
详细 (--verbose)
借助此选项，您可以输出发出的 HTTP 请求和收到的响应的详细信息。
用法示例
$ chronicle_cli forwarders list --verbose
导出 (--export)
通过此选项，您可以指定 list 输出
命令将导出同时支持相对路径和绝对路径。
用法示例
$ chronicle_cli forwarders list --export=$HOME/listForwarderssResponse
文件格式 (--file-format)
通过此选项，您可以指定使用
list 命令。支持以下三种格式：CSV、JSON 和 TXT。如果
选项未指定 --export 选项，则系统会默认使用 CSV 格式。
用法示例
$ chronicle_cli forwarders list --export=$HOME/listForwardersResponse --file-format=JSON
示例输出
JSON 格式
{
"forwarders": [
{
"name": "55a77e24-9d16-4638-8940-0ef8071ed849",
"displayName": "new",
"config": {
"uploadCompression": true,
"metadata": {
"assetNamespace": "test",
"labels": [
{
"key": "k",
"value": "v"
},
{
"key": "k1",
"value": "v1"
}
]
},
"regexFilters": [
{
"description": "desc1",
"regexp": ".*",
"behavior": "ALLOW"
}
],
"serverSettings": {
"gracefulTimeout": 15,
"drainTimeout": 10,
"httpSettings": {
"port": 8080,
"host": "0.0.0.0",
"readTimeout": 3,
"readHeaderTimeout": 3,
"writeTimeout": 3,
"idleTimeout": 3,
"routeSettings": {
"availableStatusCode": 204,
"readyStatusCode": 204,
"unreadyStatusCode": 503
}
},
"state": "ACTIVE"
}
},
"state": "ACTIVE",
"collectors": {
"Collector [3e8243c3-7ff2-4ede-89fe-16410ffe03bd]": {
"name": "3e8243c3-7ff2-4ede-89fe-16410ffe03bd",
"displayName": "cre_test_2",
"state": "ACTIVE",
"config": {
"logType": "WINDOWS_DNS",
"metadata": {
"assetNamespace": "test",
"labels": [
{
"key": "k",
"value": "v"
}
]
},
"regexFilters": [
{
"description": "desc1",
"regexp": ".*",
"behavior": "ALLOW"
}
],
"diskBuffer": {
"state": "ACTIVE",
"directoryPath": "23",
"maxFileBufferBytes": "33"
},
"maxSecondsPerBatch": 10,
"maxBytesPerBatch": "1048576",
"fileSettings": {
"filePath": "path/file.txt"
}
}
}
}
}
]
}
CSV 格式
1. {file_name}_forwarders.csv
2. {file_name}_collectors.csv
文件的示例内容：
{file_name}_forwarders.csv：
Name,Display name,Forwarder state,[CONFIG] Upload compression,[CONFIG][METADATA] Asset namespace,[CONFIG][METADATA] Labels,[CONFIG] Regex filters,[CONFIG][SERVER_SETTINGS] Server state,[CONFIG][SERVER_SETTINGS] Graceful timeout,[CONFIG][SERVER_SETTINGS] Drain timeout,[CONFIG][SERVER_SETTINGS][HTTP_SETTINGS] Port,[CONFIG][SERVER_SETTINGS][HTTP_SETTINGS] Host,[CONFIG][SERVER_SETTINGS][HTTP_SETTINGS] Read timeout,[CONFIG][SERVER_SETTINGS][HTTP_SETTINGS] Read header timeout,[CONFIG][SERVER_SETTINGS][HTTP_SETTINGS] Write timeout,[CONFIG][SERVER_SETTINGS][HTTP_SETTINGS] Idle timeout,[CONFIG][SERVER_SETTINGS][HTTP_SETTINGS][ROUTE_SETTINGS] Available status code,[CONFIG][SERVER_SETTINGS][HTTP_SETTINGS][ROUTE_SETTINGS] Ready status code,[CONFIG][SERVER_SETTINGS][HTTP_SETTINGS][ROUTE_SETTINGS] Unready status code
0593ba21-a1c7-4279-b429-bc8df959bd59,test,ACTIVE,True,test,"k1: v1
k2: v2
",,,,,,,,,,,0,0,0
094c9e41-e7c8-407a-8b9a-eb34d608a609,test,ACTIVE,True,te,"k1: v1
k2: v2
",,,,,,,,,,,0,0,0
1189f869-5f3c-4ec7-ba48-9c80e33aadf0,test,ACTIVE,True,test,"key1: value1
key2: value2
",,ACTIVE,15,10,8080,0.0.0.0,3,4,5,8,204,204,500
{file_name}_collectors.csv
Forwarder ID,Name,Display Name,Collector state,[CONFIG] Log type,[CONFIG] Max seconds per batch,[CONFIG] Max bytes per batch,[CONFIG][METADATA] Asset namespace,[CONFIG][METADATA] Labels,[CONFIG] Regex filters,[CONFIG][DISK_BUFFER] State,[CONFIG][DISK_BUFFER] Directory path,[CONFIG][DISK_BUFFER] Max file buffer bytes,[CONFIG][FILE_SETTINGS] File path,[CONFIG][KAFKA_SETTINGS][AUTHENTICATION] username,[CONFIG][KAFKA_SETTINGS][AUTHENTICATION] password,[CONFIG][KAFKA_SETTINGS] Topic,[CONFIG][KAFKA_SETTINGS] Group id,[CONFIG][KAFKA_SETTINGS] Timeout,[CONFIG][KAFKA_SETTINGS] Brokers,[CONFIG][KAFKA_SETTINGS][TLS_SETTINGS] Certificate,[CONFIG][KAFKA_SETTINGS][TLS_SETTINGS] Certificate key,[CONFIG][KAFKA_SETTINGS][TLS_SETTINGS] Minimum tls version,[CONFIG][KAFKA_SETTINGS][TLS_SETTINGS] Insecure skip verify,[CONFIG][PCAP_SETTINGS] Network interface,[CONFIG][PCAP_SETTINGS] Bpf,[CONFIG][SPLUNK_SETTINGS][AUTHENTICATION] username,[CONFIG][SPLUNK_SETTINGS][AUTHENTICATION] Password,[CONFIG][SPLUNK_SETTINGS] Host,[CONFIG][SPLUNK_SETTINGS] Port,[CONFIG][SPLUNK_SETTINGS] Minimum window size,[CONFIG][SPLUNK_SETTINGS] Maximum windows size,[CONFIG][SPLUNK_SETTINGS] Query string,[CONFIG][SPLUNK_SETTINGS] Query mode,[CONFIG][SPLUNK_SETTINGS] Cert ignored,[CONFIG][SYSLOG_SETTINGS] Protocol,[CONFIG][SYSLOG_SETTINGS] Address,[CONFIG][SYSLOG_SETTINGS] Port,[CONFIG][SYSLOG_SETTINGS] Buffer size,[CONFIG][SYSLOG_SETTINGS] Connection timeout,[CONFIG][SYSLOG_SETTINGS][TLS_SETTINGS] Certificate,[CONFIG][SYSLOG_SETTINGS][TLS_SETTINGS] Certificate key,[CONFIG][SYSLOG_SETTINGS][TLS_SETTINGS] Minimum tls version,[CONFIG][SYSLOG_SETTINGS][TLS_SETTINGS] Insecure skip verify
1189f869-5f3c-4ec7-ba48-9c80e33aadf0,03d28371-1bcb-4b28-9364-18412de1f827,collector_2,ACTIVE,WINDOWS_DNS,10,1048576,collector_update,"key1: value1
key2: value2
",,ACTIVE,path/file.txt,23,path/to/file.txt,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
1189f869-5f3c-4ec7-ba48-9c80e33aadf0,8ba8278c-1eef-4a72-a45a-491463768c70,col_3,ACTIVE,WINDOWS_DNS,10,1048576,test,"k1: v1
",,ACTIVE,path/to/file,233,path,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
55a77e24-9d16-4638-8940-0ef8071ed849,3e8243c3-7ff2-4ede-89fe-16410ffe03bd,cre_test_2,ACTIVE,WINDOWS_DNS,10,1048576,test,"k: v
",,ACTIVE,23,33,path/file.txt,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
区域 (--region)
您可以在运行命令时通过传递 --region 标志来选择区域。如需详细了解如何设置默认区域，请参阅设置默认区域。
问题排查
错误代码
本部分根据从 API 响应收到的不同类型的响应代码，显示在控制台上对应的输出。
请参阅下表，查看每个命令的输出：
Get 命令
| 响应代码 | 控制台输出 |
| 404 | “{Forwarder|Collector}”不存在。
|
| 400 | {Forwarder|Collector} ID 无效。请输入有效的{Forwarder|Collector} ID。
|
| 任何其他响应代码 | 提取“{Forwarder|Collector}”时出错。
响应代码：{status code}
错误：{error message}
|
List 命令
| 响应代码 | 控制台输出 |
| 200 以外的任何响应代码 | 错误：
响应代码：{status code}
错误：{error message}
|
Create 命令
| 响应代码 | 控制台输出 |
| 200 以外的任何响应代码 | 创建 {forwarder|collector} 时出错
响应代码：{status code}
错误：{error message}
|
Update 命令
| 响应代码 | 控制台输出 |
| 200 以外的任何响应代码 | 更新“{forwarder|collector}”时出错。响应代码：{status code}
错误：{error message}
|
Delete 命令
| 响应代码 | 控制台输出 |
| 404 | “{Forwarder|Collector}”不存在。
|
| 400 | {Forwarder|Collector} ID 无效。请输入有效的{Forwarder|Collector} ID。
|
| 任何其他响应代码 | 删除 {Forwarder|Collector} 时出错。
响应代码：{status code}
错误：{error message}
|
其他错误或异常
| 异常 | 控制台输出 |
| KeyError | 未能在响应中找到键 {key name}。
|
| 异常 | 失败，出现异常：{exception details}
|
| 缺少凭据文件 | 失败，但发生异常：[Errno 2] 没有这样的文件或目录：“/usr/local/google/home/ 您需要将凭据放置在预期目录中。请参阅安装。 |
如果您对 Google Security Operations CLI 有任何其他疑问或问题，请与 Google Security Operations 支持团队联系。
BigQuery 数据访问工作流
Google Security Operations 支持自助访问 Google Security Operations 数据（包括 SIEM 和 SOAR）。您可以使用 Google Security Operations CLI 授予 Identity and Access Management (IAM) 角色， 用户电子邮件地址的以下权限：
roles/bigquery.dataViewerroles/bigquery.jobUserroles/storage.objectViewer
电子邮件地址必须为 Google 账号和 ID 管理 (GAIA) 用户电子邮件地址 Google SecOps 客户的地址。
如需详细了解这些角色，请参阅导出表数据。
命令
bigquery 命令
bigquery 命令接受 provide_access 参数。
用法语法：
$ chronicle_cli bigquery ARGUMENT [OPTIONS]
参数
provide_access 参数
提示您输入用户电子邮件地址。该电子邮件地址必须是 Google SecOps 安全客户的 Google 账号和身份管理 (GAIA) 用户电子邮件地址。用户将获得执行以下操作所需的 IAM 角色：
- 从 BigQuery 表 (
roles/bigquery.dataViewer) 中读取数据和元数据 - 对 BigQuery 表数据运行查询 (
roles/bigquery.jobUser) - 读取 Google Cloud Storage 存储分区(
roles/storage.objectViewer) 中的数据
用法示例
$ chronicle_cli bigquery provide_access
$ Enter email: xyz@gmail.com
成功响应
Providing BigQuery access...
Access provided to email: xyz@gmail.com
错误响应
Providing BigQuery access...
Error while providing access:
Response code: 400
选项
帮助 (-h / --help)
使用 -h 或 -- 帮助选项可查看任何命令/选项的用法/说明。
问题排查
本部分根据从 API 响应收到的不同类型的响应代码，显示在控制台上对应的输出。
provide_access 参数响应代码
| 响应代码 | 控制台输出 |
| 400 | 电子邮件地址不存在。 |
| 任何其他响应代码 | 提取 Feed 时出错。
响应代码：{status code}
错误：{error message}
|