Skip to content

Latest commit

 

History

History
73 lines (53 loc) · 2.46 KB

README.md

File metadata and controls

73 lines (53 loc) · 2.46 KB
Raw

Note: The cbn-tool CLI will be deprecated on 29 December, 2023. Developers are requested to use the new Chronicle CLI.

Chronicle CBN Tool

Command line tool to interact with Chronicle's Config Based Normalizer APIs.

Config Based Normalizer (CBN) APIs allow customers to manage config based parsers that normalize logs published to Chronicle. This script provides a command line tool to interact with CBN APIs and manage config based parsers.

Setup

Follow these instructions: https://cloud.google.com/python/setup

You may skip installing the Cloud Client Libraries and the Cloud SDK, they are unnecessary for interacting with Chronicle.

After creating and activating the virtual environment venv, install Python library dependencies by running this command:

pip install -r requirements.txt

It is assumed that you're using Python 3.6 or above.

Credentials

Running the samples requires a JSON credentials file. By default, all the samples try to use the file .chronicle_credentials.json in the user's home directory. If this file is not found, you need to specify it explicitly by adding the following argument to the sample's command-line:

--credentials_file <path>

Usage

  • Getting Sample Logs
./cbn_cli.py --credentials_file=~/.chronicle_credentials.json gen --log_type=TANIUM_TH --start_date=2020-03-01T00:00:00Z --end_date=2020-03-15T12:00:00Z
  • Running Validation
python cbn_cli.py --credentials_file=~/.chronicle_credentials.json run --conf_file=tanium_th.conf --log_file=TANIUM_TH_1k.log
  • Submitting a new parser
python cbn_cli.py --credentials_file=~/.chronicle_credentials.json submit --conf_file=tanium_th.conf --log_type=TANIUM_TH --author=foo@bar.com
  • Getting status of a submitted parser
python cbn_cli.py --credentials_file=~/.chronicle_credentials.json status --config_id=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
  • Getting history of a given parser
python cbn_cli.py --credentials_file=~/.chronicle_credentials.json history --log_type=TANIUM_TH
  • List all parsers of a given customer
python cbn_cli.py --credentials_file=~/.chronicle_credentials.json list
  • List errors of a log_type between specific timestamps
python cbn_cli.py --credentials_file=~/.chronicle_credentials.json err --start_date=2020-09-16T00:00:00Z --end_date=2020-09-18T12:00:00Z --log_type=TANIUM_TH