custom action on top of the chronicle integration to fetch alerts from legacySearchAlerts

Hey!

So, the service account (SA) you have configured in the Chronicle Integration doesn't use the same API as the endpoint you're trying to use. All methods under Chronicle API (Alpha1) require an SA in the project associated with your deployment—this would be a project from your organization.

Chronicle Integration leverages an SA in a Google-managed project and uses different API methods.

Are you trying to get a list of alerts to use in the playbook? Is there any specific data you are trying to retrieve?

If all you want to do is use the endpoint and capture the response—basically just hitting the API—you could use the new GoogleCloudApi integration (you will need a new set of credentials—a new SA). Then, you can pretty much use any endpoint under the Chronicle API, depending on the permissions of the SA. If you can provide additional details about your use case, I might be able to give you some alternatives and more details on how to implement it.

Good day,

First of all, Thank you very much @josemarin  for the reply!

“Are you trying to get a list of alerts to use in the playbook? Is there any specific data you are trying to retrieve?”

Yes, We will basically capture the json response body (a list of the closed alerts), then use a playbook to process these alerts and generate metadata and then archive the alerts with their associated information somewhere. Basically this is my use case, I am also trying to avoid using listalert since it is getting deprecated.

May I know what do you mean by the new GoogleCloudAPI integration ?

On 09/25 Google released an integration to the market place called "Google Cloud API". It basically works the same way as this one, but its specific for Google Apis where you need a SA and Scopes to authenticate to the API. Its like having a "Postman" client of sort inside SecOps. Very useful for capturing API requests or just hitting API endpoints. 

If you are planning to do a lot of parsing and heavy logic on the result, you might need to go the python way, but that will have to be a separate integration from the Chronicle one. 

Hi @josemarin , do you think it makes sense to just add the necessary permissions to the default service account that is being managed by google on the chronicle SIEM project level from our end in order to interact with the required API endpoint ?