Repository navigation
fix: resolve REST Ingestion 400 INVALID_ARGUMENT and CLI runtime initialization - #60
Merged
Merged
Conversation
…tion (Issue #59) - Fix parameter validation in logstory.py to accept and validate CLI --project-id even when LOGSTORY_PROJECT_ID environment variable is unset. - Add get_project_id_default helper and pass resolved project ID to environment. - Correct REST_REGION_NAME_MAP so us and europe map to multi-region endpoints us and europe rather than regional locations that return 404. - Add _get_parent and _get_resolved_region helpers on RestIngestionBackend to ensure API endpoint and parent resource locations match. - Safely handle forwarder resolution in _get_or_create_forwarder by returning None instead of invalid 'default' string, omitting forwarder from inline_source. - Format ingestion timestamps using RFC 3339 UTC with Z suffix (%Y-%m-%dT%H:%M:%S.%fZ). - Fix ImportEntitiesRequest payload structure by placing log_type on inline_source rather than inside each entity dictionary. - Update and expand unit test suites in test_cli.py and test_ingestion.py.
… replay (Issue #59) TAG=agy CONV=db7f5985-4477-42a8-8f7f-11c7b558f9eb
TAG=agy CONV=db7f5985-4477-42a8-8f7f-11c7b558f9eb
#59) TAG=agy CONV=db7f5985-4477-42a8-8f7f-11c7b558f9eb
…usecases TAG=agy CONV=db7f5985-4477-42a8-8f7f-11c7b558f9eb
TAG=agy CONV=db7f5985-4477-42a8-8f7f-11c7b558f9eb
Allow usecase log files under src/logstory/usecases/ to be tracked in git and included in package distributions. TAG=agy CONV=db7f5985-4477-42a8-8f7f-11c7b558f9eb
… import (Issue #59) The SecOps REST entities:import endpoint expects Entity proto objects which do not have a top-level labels field. TAG=agy CONV=db7f5985-4477-42a8-8f7f-11c7b558f9eb
When authenticated client encounters credentials or refresh errors, fall back to anonymous GCS client to allow downloading public usecases. TAG=agy CONV=db7f5985-4477-42a8-8f7f-11c7b558f9eb
…count credentials for GCS TAG=agy CONV=db7f5985-4477-42a8-8f7f-11c7b558f9eb
…credentials TAG=agy CONV=db7f5985-4477-42a8-8f7f-11c7b558f9eb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Resolves #59 by fixing payload formatting and regional endpoint resolution for the Chronicle REST API ingestion backend, enabling CLI parameter validation for
--project-id, adding lazy runtime backend initialization, and bundling default workshop usecases.Changes
_get_resolved_region()and_get_parent()) to route multi-region US and Europe instances tous-chronicle.googleapis.comandeurope-chronicle.googleapis.com.get_project_id_default()and updated_load_and_validate_params()to validate--project-idfrom CLI options without requiring environment variables.Zsuffix (%Y-%m-%dT%H:%M:%S.%fZ) onevent_timestamp,log_entry_time, andcollection_time.ImportEntitiesRequestby placinglog_typeat the root ofinline_sourcerather than inside individual entity objects."forwarder"frominline_sourcewhen creation or lookup fails.get_ingestion_backend()lazy loading inmain.pyand ensured cache invalidation when CLI arguments or.envvariables are loaded.--entitiesis specified for a usecase that has no entity logs.EDR_WORKSHOP,HIGH_RISK_USER_DOWNLOAD_EXECUTABLE_FROM_MACRO, andMALWARE_IOCinsrc/logstory/usecases/.Closes #59