Skip to content

Commit baf053a

Browse files
KakudouKakudou
committed
🔧 refactor(settings): remove chronicle_ prefix from all config fields
1 parent be72c00 commit baf053a

12 files changed

Lines changed: 297 additions & 128 deletions

File tree

‎external-import/google-secops-siem-incidents/.env.sample‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@ CONNECTOR_LOG_LEVEL=error
1313
CONNECTOR_DURATION_PERIOD=PT1H
1414

1515
# Google SecOps SIEM Incidents — Chronicle API credentials
16-
GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_BASE_URL=https://chronicle.googleapis.com
17-
GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PROJECT_ID=ChangeMe
18-
GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PROJECT_REGION=ChangeMe
19-
GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PROJECT_INSTANCE=ChangeMe
20-
GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PRIVATE_KEY=ChangeMe
21-
GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PRIVATE_KEY_ID=ChangeMe
22-
GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_CLIENT_EMAIL=ChangeMe
23-
GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_CLIENT_ID=ChangeMe
24-
GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_CLIENT_CERT_URL=ChangeMe
16+
GOOGLE_SECOPS_SIEM_INCIDENTS_BASE_URL=https://chronicle.googleapis.com
17+
GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_ID=ChangeMe
18+
GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_REGION=ChangeMe
19+
GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_INSTANCE=ChangeMe
20+
GOOGLE_SECOPS_SIEM_INCIDENTS_PRIVATE_KEY=ChangeMe
21+
GOOGLE_SECOPS_SIEM_INCIDENTS_PRIVATE_KEY_ID=ChangeMe
22+
GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_EMAIL=ChangeMe
23+
GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_ID=ChangeMe
24+
GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_CERT_URL=ChangeMe
2525
GOOGLE_SECOPS_SIEM_INCIDENTS_TLP_LEVEL=amber
2626
GOOGLE_SECOPS_SIEM_INCIDENTS_FIRST_START_TIME=P1D

‎external-import/google-secops-siem-incidents/README.md‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424

2525
## Introduction
2626

27-
This connector fetches SIEM rule alerts from the Google SecOps Chronicle API and imports them into OpenCTI as STIX 2.1 objects. Each Chronicle rule alert is mapped to an OpenCTI Incident, enriched with related observables (IP addresses, hostnames, user accounts, files) and linked via STIX relationships.
27+
This connector fetches SIEM rule alerts from the Google SecOps API and imports them into OpenCTI as STIX 2.1 objects. Each rule alert is mapped to an OpenCTI Incident, enriched with related observables (IP addresses, hostnames, user accounts, files) and linked via STIX relationships.
2828

2929
The connector uses forward-sliding pagination: on first run it fetches alerts back to a configurable lookback window; on subsequent runs it resumes from the last processed alert timestamp.
3030

@@ -33,8 +33,8 @@ The connector uses forward-sliding pagination: on first run it fetches alerts ba
3333
### Requirements
3434

3535
- OpenCTI Platform version >= 6.x
36-
- Google SecOps Chronicle access with a GCP service account authorized for the `https://www.googleapis.com/auth/cloud-platform` scope
37-
- Chronicle project ID, region, instance UUID, and service account credentials
36+
- Google SecOps access with a GCP service account authorized for the `https://www.googleapis.com/auth/cloud-platform` scope
37+
- Google SecOps project ID, region, instance UUID, and service account credentials
3838

3939
## Configuration variables
4040

@@ -61,19 +61,19 @@ There are a number of configuration options, which are set either in `docker-com
6161

6262
| Parameter | Docker environment variable | Default | Mandatory | Description |
6363
|-------------------------|----------------------------------------------------------------|------------------------------------------|-----------|--------------------------------------------------------------------------------------------------|
64-
| Chronicle base URL | `GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_BASE_URL` | `https://chronicle.googleapis.com` | No | Chronicle API base URL. A region prefix is prepended at runtime. |
65-
| GCP project ID | `GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PROJECT_ID` | / | Yes | Google Cloud project ID associated with the Chronicle instance. |
66-
| Chronicle region | `GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PROJECT_REGION` | / | Yes | Chronicle region prefix (e.g. `us`, `eu`, `asia`). |
67-
| Chronicle instance | `GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PROJECT_INSTANCE` | / | Yes | Chronicle instance UUID. |
68-
| Private key (PEM) | `GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PRIVATE_KEY` | / | Yes | Service account private key in PEM format. |
69-
| Private key ID | `GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PRIVATE_KEY_ID` | / | Yes | Service account private key ID. |
70-
| Client email | `GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_CLIENT_EMAIL` | / | Yes | Service account client email (`*@*.iam.gserviceaccount.com`). |
71-
| Client ID | `GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_CLIENT_ID` | / | Yes | Service account client ID (numeric). |
72-
| Client cert URL | `GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_CLIENT_CERT_URL` | / | Yes | Service account client certificate URL. |
64+
| Base URL | `GOOGLE_SECOPS_SIEM_INCIDENTS_BASE_URL` | `https://chronicle.googleapis.com` | No | Google SecOps API base URL. A region prefix is prepended at runtime. |
65+
| GCP project ID | `GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_ID` | / | Yes | Google Cloud project ID associated with the Google SecOps instance. |
66+
| Region | `GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_REGION` | / | Yes | Google SecOps region prefix (e.g. `us`, `eu`, `asia`). |
67+
| Instance | `GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_INSTANCE` | / | Yes | Google SecOps instance UUID. |
68+
| Private key (PEM) | `GOOGLE_SECOPS_SIEM_INCIDENTS_PRIVATE_KEY` | / | Yes | Service account private key in PEM format. |
69+
| Private key ID | `GOOGLE_SECOPS_SIEM_INCIDENTS_PRIVATE_KEY_ID` | / | Yes | Service account private key ID. |
70+
| Client email | `GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_EMAIL` | / | Yes | Service account client email (`*@*.iam.gserviceaccount.com`). |
71+
| Client ID | `GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_ID` | / | Yes | Service account client ID (numeric). |
72+
| Client cert URL | `GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_CERT_URL` | / | Yes | Service account client certificate URL. |
7373
| TLP level | `GOOGLE_SECOPS_SIEM_INCIDENTS_TLP_LEVEL` | `amber` | No | TLP marking applied to all imported entities. Values: `clear`, `white`, `green`, `amber`, `amber+strict`, `red`. |
7474
| First start time | `GOOGLE_SECOPS_SIEM_INCIDENTS_FIRST_START_TIME` | `P1D` | No | How far back to fetch alerts on the very first run (ISO 8601 duration). Only used when no prior state exists. |
7575

76-
> **Tip — service account JSON:** All `CHRONICLE_*` credential fields map directly to the fields inside a GCP service account JSON key file. You can source them from there directly.
76+
> **Tip — service account JSON:** All credential fields map directly to the fields inside a GCP service account JSON key file. You can source them from there directly.
7777
7878
## Deployment
7979

@@ -91,14 +91,14 @@ Register the connector in your main OpenCTI `docker-compose.yml`:
9191
- OPENCTI_TOKEN=ChangeMe
9292
- CONNECTOR_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
9393
- CONNECTOR_NAME=Google SecOps
94-
- GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PROJECT_ID=my-gcp-project
95-
- GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PROJECT_REGION=us
96-
- GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PROJECT_INSTANCE=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
97-
- GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----
98-
- GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_PRIVATE_KEY_ID=ChangeMe
99-
- GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_CLIENT_EMAIL=my-sa@my-project.iam.gserviceaccount.com
100-
- GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_CLIENT_ID=123456789
101-
- GOOGLE_SECOPS_SIEM_INCIDENTS_CHRONICLE_CLIENT_CERT_URL=https://www.googleapis.com/robot/v1/metadata/x509/...
94+
- GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_ID=my-gcp-project
95+
- GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_REGION=us
96+
- GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_INSTANCE=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
97+
- GOOGLE_SECOPS_SIEM_INCIDENTS_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----
98+
- GOOGLE_SECOPS_SIEM_INCIDENTS_PRIVATE_KEY_ID=ChangeMe
99+
- GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_EMAIL=my-sa@my-project.iam.gserviceaccount.com
100+
- GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_ID=123456789
101+
- GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_CERT_URL=https://www.googleapis.com/robot/v1/metadata/x509/...
102102
restart: always
103103
```
104104
@@ -132,14 +132,14 @@ To force an immediate run, navigate to **Data management → Ingestion → Conne
132132

133133
- On **first run**, fetches alerts from `now - FIRST_START_TIME` to `now`.
134134
- On **subsequent runs**, resumes from the last processed alert `detection_timestamp + 1s` (persisted in connector state as `last_alert_timestamp`); the +1s offset ensures the boundary alert is not re-fetched on the next run.
135-
- If the Chronicle API returns `tooManyAlerts=true`, the query window slides **backward**: the `endTime` is replaced by the oldest `detection_timestamp` in the current batch, and fetching continues until all pages are consumed.
135+
- If the API returns `tooManyAlerts=true`, the query window slides **backward**: the `endTime` is replaced by the oldest `detection_timestamp` in the current batch, and fetching continues until all pages are consumed.
136136
- Each alert batch is converted to STIX objects and sent as a bundle before advancing state — ensuring no data loss on partial runs.
137137
- If a paginated run is **interrupted** (crash, restart), the connector persists a `pagination_checkpoint` after each truncated batch. On the next run it detects the checkpoint and resumes the backward-pagination window from where it left off, then clears the checkpoint on clean completion.
138138

139139
### Mapping to OpenCTI entities
140140

141-
| Chronicle source | OpenCTI / STIX 2.1 entity |
142-
|----------------------------|-------------------------------|
141+
| Google SecOps source | OpenCTI / STIX 2.1 entity |
142+
|------------------------------|-------------------------------|
143143
| Rule alert | Incident |
144144
| `principal_ip` outcome | IPv4 / IPv6 Address |
145145
| `principal_hostname` | Hostname |
@@ -165,4 +165,4 @@ Common errors and their causes:
165165
|---|---|
166166
| `Google authentication failed` | Invalid or expired service account key — check `client_email` and `private_key` in your credentials. |
167167
| `invalid_grant: account not found` | The service account does not exist or has been deleted in GCP. |
168-
| `Invalid IP V4 address` | Chronicle returned an empty IP string in an alert outcome — safe to ignore, patched from version X. |
168+
| `Invalid IP V4 address` | Google SecOps returned an empty IP string in an alert outcome — safe to ignore, patched from version X. |

‎external-import/google-secops-siem-incidents/__metadata__/CONNECTOR_CONFIG_DOC.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Connector Configurations
2+
3+
Below is an exhaustive enumeration of all configurable parameters available, each accompanied by detailed explanations of their purposes, default behaviors, and usage guidelines to help you understand and utilize them effectively.
4+
5+
### Type: `object`
6+
7+
| Property | Type | Required | Possible values | Default | Description |
8+
| -------- | ---- | -------- | --------------- | ------- | ----------- |
9+
| OPENCTI_URL | `string` | ✅ | Format: [`uri`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | | The base URL of the OpenCTI instance. |
10+
| OPENCTI_TOKEN | `string` | ✅ | string | | The API token to connect to OpenCTI. |
11+
| GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_ID | `string` | ✅ | string | | GCP project ID. |
12+
| GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_REGION | `string` | ✅ | string | | Chronicle region (e.g. 'us', 'eu', 'asia'). |
13+
| GOOGLE_SECOPS_SIEM_INCIDENTS_PROJECT_INSTANCE | `string` | ✅ | string | | Chronicle instance UUID. |
14+
| GOOGLE_SECOPS_SIEM_INCIDENTS_PRIVATE_KEY | `string` | ✅ | string | | Service account private key (PEM). |
15+
| GOOGLE_SECOPS_SIEM_INCIDENTS_PRIVATE_KEY_ID | `string` | ✅ | string | | Service account private key ID. |
16+
| GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_EMAIL | `string` | ✅ | string | | Service account client email. |
17+
| GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_ID | `string` | ✅ | string | | Service account client ID. |
18+
| GOOGLE_SECOPS_SIEM_INCIDENTS_CLIENT_CERT_URL | `string` | ✅ | string | | Service account client cert URL. |
19+
| CONNECTOR_NAME | `string` | | string | `"Google SecOps"` | The name of the connector. |
20+
| CONNECTOR_SCOPE | `array` | | string | `["Google SecOps SIEM Incidents"]` | The scope of the connector, e.g. 'flashpoint'. |
21+
| CONNECTOR_LOG_LEVEL | `string` | | `debug` `info` `warn` `warning` `error` | `"error"` | The minimum level of logs to display. |
22+
| CONNECTOR_TYPE | `const` | | `EXTERNAL_IMPORT` | `"EXTERNAL_IMPORT"` | |
23+
| CONNECTOR_DURATION_PERIOD | `string` | | Format: [`duration`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | `"PT1H"` | The period of time to await between two runs of the connector. |
24+
| GOOGLE_SECOPS_SIEM_INCIDENTS_BASE_URL | `string` | | string | `"https://chronicle.googleapis.com"` | Chronicle API base URL (region prefix added at runtime). |
25+
| GOOGLE_SECOPS_SIEM_INCIDENTS_AUTH_URI | `string` | | string | `"https://accounts.google.com/o/oauth2/auth"` | OAuth2 auth URI. |
26+
| GOOGLE_SECOPS_SIEM_INCIDENTS_TOKEN_URI | `string` | | string | `"https://oauth2.googleapis.com/token"` | OAuth2 token URI. |
27+
| GOOGLE_SECOPS_SIEM_INCIDENTS_AUTH_PROVIDER_CERT | `string` | | string | `"https://www.googleapis.com/oauth2/v1/certs"` | OAuth2 auth provider cert URL. |
28+
| GOOGLE_SECOPS_SIEM_INCIDENTS_TLP_LEVEL | `string` | | `clear` `white` `green` `amber` `amber+strict` `red` | `"amber"` | Default TLP level of the imported entities. |
29+
| GOOGLE_SECOPS_SIEM_INCIDENTS_FIRST_START_TIME | `string` | | Format: [`duration`](https://json-schema.org/understanding-json-schema/reference/string#built-in-formats) | `"P1D"` | How far back to fetch alerts on the very first run (ISO-8601 duration, e.g. P1D). Used only when no prior state exists. |

0 commit comments

Comments
 (0)