Ingestion API: Chronicle

Dear All,
Can anyone help me in rectifying this error?
python3 ingest.py
Traceback (most recent call last):
File "/home/CBN-CLI/ingestion/ingest.py", line 50, in <module>
from common import regions
ImportError: cannot import name 'regions' from 'common' (/home/CBN-CLI/venv/cli/common/__init__.py)

Reference:api-samples-python/forwarders/create_collector.py at master · chronicle/api-samples-python · GitHub

Thanks

The correct script to send data in UDM format is https://github.com/chronicle/api-samples-python/blob/master/ingestion/create_udm_events.py. 

If you want to send raw logs, then you can use the following:

https://github.com/chronicle/api-samples-python/blob/master/ingestion/create_unstructured_log_entries.py

Note that you need the Ingestion API key to send data to Chronicle.

Hi @Rene_Figueroa,
Thank you for the reply.
I tried running the script with the credential file in ~/.chronicle_credentials.json and ran the below command but I'm not getting any result or error. Please find the below image.

Thank you,

Normally, if you do not get any errors, that means a successful request. Our UDM endpoint does not ask for a log type though. See our reference:

https://cloud.google.com/chronicle/docs/reference/ingestion-api#udmevents

Did you happen to use the endpoint to send raw log data by any chance? 

I normally call the UDM script in our sample code in the following manner:

Hi @Rene_Figueroa,
I tried both the ways but same result, Its not giving any error or result.
Is it because the service account (JSON file) doesn't have enough permission?
Thanks,
Aravind 

Note that the data inside SIEM will be tagged as UDM if you send data using our UDM API endpoint.

Hi @Rene_Figueroa,
Thank you for the reply.
Right, But I can't see the logs which are ingesting.
Thanks,
Aravind