|
| 1 | +#!/usr/bin/env python3 |
| 2 | + |
| 3 | +# Copyright 2024 Google LLC |
| 4 | +# |
| 5 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | +# you may not use this file except in compliance with the License. |
| 7 | +# You may obtain a copy of the License at |
| 8 | +# |
| 9 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +# |
| 11 | +# Unless required by applicable law or agreed to in writing, software |
| 12 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | +# See the License for the specific language governing permissions and |
| 15 | +# limitations under the License. |
| 16 | +# |
| 17 | +r"""Executable and reusable sample for getting a Reference List. |
| 18 | +
|
| 19 | +Usage: |
| 20 | + python -m alerts.v1alpha.get_alert \ |
| 21 | + --project_id=<PROJECT_ID> \ |
| 22 | + --project_instance=<PROJECT_INSTANCE> \ |
| 23 | + --alert_id=<ALERT_ID> |
| 24 | +
|
| 25 | +API reference: |
| 26 | + https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetAlert |
| 27 | +
|
| 28 | +""" |
| 29 | + |
| 30 | +import argparse |
| 31 | +import json |
| 32 | +from typing import Any, Mapping |
| 33 | + |
| 34 | +from common import chronicle_auth |
| 35 | +from common import project_id |
| 36 | +from common import project_instance |
| 37 | +from common import regions |
| 38 | + |
| 39 | +from google.auth.transport import requests |
| 40 | + |
| 41 | +CHRONICLE_API_BASE_URL = "https://chronicle.googleapis.com" |
| 42 | +SCOPES = [ |
| 43 | + "https://www.googleapis.com/auth/cloud-platform", |
| 44 | +] |
| 45 | + |
| 46 | + |
| 47 | +def get_alert( |
| 48 | + http_session: requests.AuthorizedSession, |
| 49 | + proj_id: str, |
| 50 | + proj_instance: str, |
| 51 | + proj_region: str, |
| 52 | + alert_id: str, |
| 53 | + include_detections: bool = False, |
| 54 | +) -> Mapping[str, Any]: |
| 55 | + """Gets an Alert. |
| 56 | +
|
| 57 | + Args: |
| 58 | + http_session: Authorized session for HTTP requests. |
| 59 | + proj_id: GCP project id or number to which the target instance belongs. |
| 60 | + proj_instance: Customer ID (uuid with dashes) for the Chronicle instance. |
| 61 | + proj_region: region in which the target project is located. |
| 62 | + alert_id: Identifier for the alert. |
| 63 | + include_detections: Flag to include detections. |
| 64 | +
|
| 65 | + Returns: |
| 66 | + Dictionary representation of the Alert |
| 67 | +
|
| 68 | + Raises: |
| 69 | + requests.exceptions.HTTPError: HTTP request resulted in an error |
| 70 | + (response.status_code >= 400). |
| 71 | + """ |
| 72 | + base_url_with_region = regions.url_always_prepend_region( |
| 73 | + CHRONICLE_API_BASE_URL, |
| 74 | + proj_region |
| 75 | + ) |
| 76 | + # pylint: disable-next=line-too-long |
| 77 | + parent = f"projects/{proj_id}/locations/{proj_region}/instances/{proj_instance}" |
| 78 | + |
| 79 | + query_params = {"alertId": alert_id} |
| 80 | + if include_detections: |
| 81 | + query_params["includeDetections"] = True |
| 82 | + |
| 83 | + url = f"{base_url_with_region}/v1alpha/{parent}/legacy:legacyGetAlert" |
| 84 | + |
| 85 | + response = http_session.request("GET", url, params=query_params) |
| 86 | + # Expected server response is described in: |
| 87 | + # https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyGetAlert |
| 88 | + if response.status_code >= 400: |
| 89 | + print(response.text) |
| 90 | + response.raise_for_status() |
| 91 | + return response.json() |
| 92 | + |
| 93 | + |
| 94 | +if __name__ == "__main__": |
| 95 | + parser = argparse.ArgumentParser() |
| 96 | + chronicle_auth.add_argument_credentials_file(parser) |
| 97 | + project_instance.add_argument_project_instance(parser) |
| 98 | + project_id.add_argument_project_id(parser) |
| 99 | + regions.add_argument_region(parser) |
| 100 | + parser.add_argument( |
| 101 | + "--alert_id", type=str, required=True, |
| 102 | + help="identifier for the alert" |
| 103 | + ) |
| 104 | + parser.add_argument( |
| 105 | + "-d", "--include-detections", type=bool, default=False, required=False, |
| 106 | + help="flag to include detections" |
| 107 | + ) |
| 108 | + args = parser.parse_args() |
| 109 | + |
| 110 | + auth_session = chronicle_auth.initialize_http_session( |
| 111 | + args.credentials_file, |
| 112 | + SCOPES, |
| 113 | + ) |
| 114 | + alert = get_alert( |
| 115 | + auth_session, |
| 116 | + args.project_id, |
| 117 | + args.project_instance, |
| 118 | + args.region, |
| 119 | + args.alert_id, |
| 120 | + args.include_detections, |
| 121 | + ) |
| 122 | + print(json.dumps(alert, indent=2)) |
0 commit comments