Add sample code for VerifyRule.

Chronicle Team · copybara-github · commit 7d553c44281a · 2021-06-29T10:14:20.000-07:00
PiperOrigin-RevId: 382111530
diff --git a/detect/v2/verify_rule.py b/detect/v2/verify_rule.py
@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+"""Executable and reusable sample for verifying a detection rule."""
+
+import argparse
+import json
+from typing import Any, Mapping
+
+from google.auth.transport import requests
+
+from common import chronicle_auth
+
+CHRONICLE_API_BASE_URL = "https://backstory.googleapis.com"
+
+
+def verify_rule(http_session: requests.AuthorizedSession,
+                rule_content: str) -> Mapping[str, Any]:
+  """Validates that a detection rule is a valid YL2 rule.
+
+  Args:
+    http_session: Authorized session for HTTP requests.
+    rule_content: Content of the detection rule.
+
+  Returns:
+    A compilation error if there is one.
+
+  Raises:
+    requests.exceptions.HTTPError: HTTP request resulted in an error
+      (response.status_code >= 400).
+  """
+  url = f"{CHRONICLE_API_BASE_URL}/v2/detect/rules:verifyRule"
+  body = {"rule_text": rule_content}
+
+  response = http_session.request("POST", url, json=body)
+  # Expected server response:
+  # {
+  #   "compilationError": "<error_message>", <-- IFF compilation failed.
+  # }
+
+  if response.status_code >= 400:
+    print(response.text)
+  response.raise_for_status()
+  return response.json()
+
+
+if __name__ == "__main__":
+  parser = argparse.ArgumentParser()
+  chronicle_auth.add_argument_credentials_file(parser)
+  parser.add_argument(
+      "-f",
+      "--rule_file",
+      type=argparse.FileType("r"),
+      required=True,
+      # File example: python3 verify_rule.py -f <path>
+      # STDIN example: cat rule.txt | python3 verify_rule.py -f -
+      help="path of a file with the rule's content, or - for STDIN")
+
+  args = parser.parse_args()
+  session = chronicle_auth.initialize_http_session(args.credentials_file)
+  resp = verify_rule(session, args.rule_file.read())
+  print(json.dumps(resp, indent=2))
diff --git a/detect/v2/verify_rule_test.py b/detect/v2/verify_rule_test.py
@@ -0,0 +1,53 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+"""Unit tests for the "verify_rule" module."""
+
+import unittest
+from unittest import mock
+
+from google.auth.transport import requests
+
+from . import verify_rule
+
+
+class VerifyRuleTest(unittest.TestCase):
+
+  @mock.patch.object(requests, "AuthorizedSession", autospec=True)
+  @mock.patch.object(requests.requests, "Response", autospec=True)
+  def test_http_error(self, mock_response, mock_session):
+    mock_session.request.return_value = mock_response
+    type(mock_response).status_code = mock.PropertyMock(return_value=400)
+    mock_response.raise_for_status.side_effect = (
+        requests.requests.exceptions.HTTPError())
+
+    with self.assertRaises(requests.requests.exceptions.HTTPError):
+      verify_rule.verify_rule(mock_session, "new rule content")
+
+  @mock.patch.object(requests, "AuthorizedSession", autospec=True)
+  @mock.patch.object(requests.requests, "Response", autospec=True)
+  def test_happy_path(self, mock_response, mock_session):
+    mock_session.request.return_value = mock_response
+    type(mock_response).status_code = mock.PropertyMock(return_value=200)
+    expected_resp = {
+        "compilationError": "generic::invalid_argument compilation error",
+    }
+    mock_response.json.return_value = expected_resp
+
+    actual_rule = verify_rule.verify_rule(mock_session, "new rule content")
+    self.assertEqual(actual_rule, expected_resp)
+
+
+if __name__ == "__main__":
+  unittest.main()
