Add parser validation APIs and log-type CLI commands by ishree-dev · Pull Request #201 · google/secops-wrapper

ishree-dev · 2026-03-16T11:32:34Z

This PR introduces new SDK wrapper methods and CLI commands for Chronicle Parser Validation tooling. It specifically adds functionality to trigger GitHub checks for parsers and retrieve their corresponding analysis reports.
Key Changes:

New SDK Methods (src/secops/chronicle/client.py & parser_validation.py):
trigger_github_checks: Triggers a parser analysis report against an associated GitHub PR.
get_analysis_report: Retrieves a completed parser analysis report using its full resource name.
New CLI Commands (src/secops/cli/commands/log_type.py):
- Implemented the secops log-type command group.
- secops log-type trigger-checks --associated-pr --log-type <LOG_TYPE> --customer-id
- secops log-type get-analysis-report --name <REPORT_NAME>
Testing (tests/):
- Added unit tests for the newly added ChronicleClient methods (test_client_parser_validation.py).
- Added unit tests for CLI command handlers (test_log_type.py).
- Added integration tests for the log-type CLI lifecycle (test_log_type_integration.py).
Documentation:
Updated api_module_mapping.md to map logTypes.triggerGitHubChecks and logTypes.getParserAnalysisReport to their respective CLI counterparts.

tarunz · 2026-03-16T11:33:49Z

src/secops/chronicle/client.py

            archived=archived,
            run_frequency=run_frequency,
        )
+


Please remove these lines.

prasoonbirla-google · 2026-03-18T19:39:13Z

src/secops/chronicle/parser_validation.py

+        raise SecOpsError(f"No parsers found for log type: {log_type}")
+
+    # Use the first parser's name (which includes the UUID)
+    parser_name = parsers_data["parsers"][0]["name"]


This may lead to null pointer exception. You're only checking if parsers field is present or not. It may be present and emtpy.

comment resolved

prasoonbirla-google · 2026-03-18T19:41:56Z

src/secops/chronicle/parser_validation.py

+        raise SecOpsError(f"No parsers found for log type: {log_type}")
+
+    # Use the first parser's name (which includes the UUID)
+    parser_name = parsers_data["parsers"][0]["name"]


What's the logic to choose the first parser among multiple?

multiple isnt supported right?

Are we letting the user know about that any how? We should add a log that multiple parsers are not supported if there are instead of directly choosing the first.

I will add the log then

prasoonbirla-google · 2026-03-18T19:58:54Z

src/secops/chronicle/parser_validation.py

+        APIError: If the API request fails.
+    """
+    instance_id = client.instance_id
+    if customer_id and customer_id != client.customer_id:


Can we initialize the client itself with the correct customer id if you're anyway getting it in the argument?

Check if the customer id is already available via the gcloud auth command. In that case no need to provide the customer id separately.

comment resolved

prasoonbirla-google · 2026-03-18T20:00:35Z

src/secops/chronicle/parser_validation.py

+    # First get the list of parsers for this log_type to find a valid
+    # parser UUID
+    parsers_url = f"{base_url}/{instance_id}/logTypes/{log_type}/parsers"
+    parsers_resp = client.session.get(parsers_url, timeout=timeout)


Can't we use the some information from metadata.json file instead of fetching the parsers for this logtype and then using the first available name?

we are expecting log_type from the cli command

prasoonbirla-google · 2026-03-18T20:05:17Z

src/secops/chronicle/parser_validation.py

+        )
+
+    parsers_data = parsers_resp.json()
+    if not parsers_data.get("parsers"):


If no parser exists for that log type, why are we not triggering the github check api?

comment resolved

prasoonbirla-google · 2026-03-18T20:15:26Z

src/secops/cli/commands/log_type.py

+        result = chronicle.get_analysis_report(name=args.name)
+        output_formatter(result, args.output)
+    except APIError as e:
+        print(f"API error: {e}", file=sys.stderr)


Same comment here.

prasoonbirla-google · 2026-03-18T20:15:41Z

src/secops/cli/commands/log_type.py

+    except APIError as e:
+        print(f"API error: {e}", file=sys.stderr)
+        sys.exit(1)
+    except SecOpsError as e:


When will this error come?

This SecOpsError is caught because chronicle.get_analysis_report(name=args.name) performs local input validation before sending the request. If the user passes an empty or invalid name
(e.g., less than 5 characters long), the internal client method raises a SecOpsError rather than an APIError.

prasoonbirla-google · 2026-03-18T20:17:18Z

tests/chronicle/test_client_parser_validation.py

+
+    result = mock_client.trigger_github_checks(
+        associated_pr="owner/repo/pull/123",
+        log_type="BRO_DNS",


Replace this with DUMMY_LOGTYPE

prasoonbirla-google · 2026-03-18T20:17:33Z

tests/cli/test_log_type.py

+    """Test successful trigger_checks command execution."""
+    args = Namespace(
+        associated_pr="owner/repo/pull/123",
+        log_type="BRO_DNS",


Same comment.

prasoonbirla-google · 2026-03-18T20:19:06Z

tests/cli/test_log_type_integration.py

+            "log-type",
+            "trigger-checks",
+            "--associated-pr",
+            "google/secops-wrapper/pull/1",


Why choose the 1st PR? Is that related to this project?

this is a sample pr, can be any number

prasoonbirla-google · 2026-03-24T09:52:02Z

src/secops/chronicle/parser_validation.py

+    if not isinstance(log_type, str) or len(log_type.strip()) < 2:
+        raise SecOpsError("log_type must be a valid string of length >= 2")
+    if customer_id is not None:
+        if not isinstance(customer_id, str) or len(customer_id.strip()) < 2:


Lets use pattern matching for Customer Id as its a UUID

prasoonbirla-google · 2026-03-24T09:54:33Z

src/secops/chronicle/parser_validation.py

+
+def trigger_github_checks(
+    client: "ChronicleClient",
+    associated_pr: str,


Lets add proper validations for the structure of this string, validate by breaking the path and number of substrings, valid pr number.

prasoonbirla-google · 2026-03-24T09:57:50Z

src/secops/chronicle/parser_validation.py

+    # First get the list of parsers for this log_type to find a valid
+    # parser UUID
+    parsers_url = f"{base_url}/{instance_id}/logTypes/{log_type}/parsers"
+    parsers_resp = client.session.get(parsers_url, timeout=timeout)


ishree-dev requested a review from mihirvala08 as a code owner March 16, 2026 11:32

tarunz reviewed Mar 18, 2026

View reviewed changes

prasoonbirla-google reviewed Mar 18, 2026

View reviewed changes

ishree-dev marked this pull request as draft March 20, 2026 07:35

ishree-dev marked this pull request as ready for review March 20, 2026 07:35

ishree-dev force-pushed the cli-changes branch 2 times, most recently from 1172e71 to a119b36 Compare March 23, 2026 08:02

Adding new APIs in cli

d64e6e4

ishree-dev force-pushed the cli-changes branch from a119b36 to d64e6e4 Compare March 23, 2026 08:10

prasoonbirla-google reviewed Mar 24, 2026

View reviewed changes

Conversation

ishree-dev commented Mar 16, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants