SecOps Ingestion API returns HTTP 400 when including log_type field

If you are parsing the event into UDM with your own code and not a parser within SecOps, a log_type is not required. The log_type is for setting which parser is needed. In reviewing the docs you linked, the udmevents endpoint does not require the log_type to be set (nor does it allow it): https://cloud.google.com/chronicle/docs/reference/ingestion-api#udmevents

-mike

We need a log_type to be able to parse the data.

we have already defined a custom log type in SecOps, and are working on a custom parser.

We just need the ability to send the right logtype.

Addendum, if we do this:

    body = {
        "customerId": CUSTOMER_ID,
        "logtype" : "CSE",
        "events":     events
    }

[ERROR] HTTP 400 Bad Request
{
  "error": {
    "code": 400,
    "message": "Invalid JSON payload received. Unknown name \"logtype\": Cannot find field.",
    "status": "INVALID_ARGUMENT",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.BadRequest",
        "fieldViolations": [
          {
            "description": "Invalid JSON payload received. Unknown name \"logtype\": Cannot find field."
          }
        ]
      }
    ]
  }
}

if we do this:

    body = {
        "customerId": CUSTOMER_ID,
        "logType" : "CSE",
        "events":     events
    }

we get this

[ERROR] HTTP 400 Bad Request
{
  "error": {
    "code": 400,
    "message": "Request contains an invalid argument.",
    "status": "INVALID_ARGUMENT"
  }
}

appologies if you are in dark mode, I made the actual text black…. So it got hidden...

If you are sending raw logs you’d use import.logs, and you need a parser and can specify a log_type, but if you have already created the UDM event and are using import.events then as you have already created the UDM object it is automatically of log_type = UDM, and so you can’t specify it.

The same holds for the legacy endpoints too - https://docs.cloud.google.com/chronicle/docs/reference/ingestion-api#udmevents

thanx!

We are working on the parser as we speak