Guillaume BOURGEOIS
aca1db5cad
Chronicle Backstory API, 5 commands: list IOCs, list alerts, list assets, get IOC details. Service-account RS256 JWT auth (remote engine, PyJWT + cryptography). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
77 lines
3.3 KiB
YAML
77 lines
3.3 KiB
YAML
id: chronicle
|
|
name: Google Chronicle
|
|
version: 1.0.0
|
|
description: "Google Chronicle (Backstory API) — SIEM threat context: list IOCs seen in the enterprise, list alerts, list assets, and get IOC details for an artifact. Authenticates with a Google service account (RS256 JWT bearer flow). Runs on a remote engine. Requires the Python 'PyJWT' and 'cryptography' libraries on the engine host (pip install pyjwt cryptography)."
|
|
changelog: "1.0.0 — Initial release: list IOCs, list alerts, list assets, get IOC details."
|
|
category: siem
|
|
|
|
# Per-instance configuration. The scripts build a signed RS256 assertion from the
|
|
# service account's private_key/client_email and exchange it for an access token
|
|
# (scope chronicle-backstory). base_url is the regional Chronicle API host.
|
|
config_schema:
|
|
properties:
|
|
service_account_json:
|
|
type: string
|
|
description: "Full Chronicle service account key JSON (must contain client_email and private_key)"
|
|
x-soar-sensitive: true
|
|
base_url:
|
|
type: string
|
|
description: "Chronicle API base URL (region-specific)"
|
|
default: "https://backstory.googleapis.com"
|
|
required:
|
|
- service_account_json
|
|
|
|
commands:
|
|
- id: list_iocs
|
|
name: chronicle-list-iocs
|
|
description: "List IOCs (indicators of compromise) observed in the enterprise since a start time."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
start_time: { type: string, description: "RFC3339 start time (e.g. 2024-01-01T00:00:00Z)" }
|
|
page_size: { type: number, description: "Max IOCs (default 100)" }
|
|
required: [start_time]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_alerts
|
|
name: chronicle-list-alerts
|
|
description: "List alerts in a time window."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
start_time: { type: string, description: "RFC3339 start time" }
|
|
end_time: { type: string, description: "RFC3339 end time" }
|
|
page_size: { type: number, description: "Max alerts (default 100)" }
|
|
required: [start_time, end_time]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_assets
|
|
name: chronicle-list-assets
|
|
description: "List assets that accessed an artifact (domain, IP, or hash) in a time window."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
artifact_type: { type: string, description: "domain_name, destination_ip_address, or hash_sha256" }
|
|
artifact_value: { type: string, description: "The artifact value" }
|
|
start_time: { type: string, description: "RFC3339 start time" }
|
|
end_time: { type: string, description: "RFC3339 end time" }
|
|
required: [artifact_type, artifact_value, start_time, end_time]
|
|
outputs_schema: { properties: {} }
|
|
- id: ioc_details
|
|
name: chronicle-ioc-details
|
|
description: "Get IOC details for an artifact (domain, IP, or hash)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
artifact_type: { type: string, description: "domain_name, destination_ip_address, or hash_sha256" }
|
|
artifact_value: { type: string, description: "The artifact value" }
|
|
required: [artifact_type, artifact_value]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: chronicle-test-connection
|
|
description: "Verify the service-account token exchange (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|