Google Chronicle Backstory

Deprecation Notice

The “Chronicle” integration currently relies on the Backstory API, which is being deprecated in favor of the more modern and supported Google SecOps v1alpha API.

We have built a new “Google SecOps” (v1alpha API) integration for Cortex XSOAR, and it will be part of the existing pack.

What this means for you:

• The current “Chronicle” (Backstory API) integration will remain functional but will no longer actively maintained or supported.
• The new “Google SecOps” (v1alpha API) integration will offer similar functionality and command structure, with additional backend improvements.

We recommend migrating to the new “Google SecOps” integration to ensure continued support, compatibility, and access to the latest updates.

If you have any questions or need assistance, please reach out via XSOAR Support Contact.

Overview

Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

Note: The gcb-list-alerts command would fetch both Asset as well as User alerts depending upon the argument alert_type. In this case, the total number of alerts fetched might not match with the value of the page_size argument and this is a known behaviour with respect to the endpoint from which we are fetching the alerts.

Note: The gcb-list-rules command would filter rules depending upon the argument live_rule.In this case, the total number of rules fetched might not match with the value of the page_size argument and this is a known behaviour with respect to the endpoint from which we are fetching the rules.

Note: The commands and fetch incidents mechanism will do up to 3 internal retries with a gap of 15, 30, and 60 seconds (exponentially) between the retries.

Troubleshoot

Note: If you are expecting a high volume of alerts from Chronicle, you can reduce the time required to fetch them by increasing the “How many incidents to fetch each time” parameter while decreasing the “Incidents Fetch Interval” parameter in the integration configuration.

Problem #1

Duplication of rule detection incidents when fetched from Chronicle.

Solution #1

• The incidents are re-fetched starting from first fetch time window when user resets the last run time stamp.
• To avoid duplication of incidents with duplicate detection ids and to drop them, XSOAR provides inbuilt features of Pre-process rules.
• This setting XSOAR platform end users have to set on their own as it’s not part of the integration pack.
• Pre-processing rules enable users to perform certain actions on incidents as they are ingested into XSOAR.
• Using these rules users can choose incoming events on which to perform actions for example drop all the incoming incidents, drop and update incoming incidents if certain conditions are met.
• Please refer for information on Pre-Process rules:
  https://xsoar.pan.dev/docs/incidents/incident-pre-processing#:~:text=Creating%20Rules&text=Navigate%20to%20Settings%20%3E%20Integrations%20%3E%20Pre,viewing%20the%20list%20of%20rules.

FAQ - Fetch Detections

Question #1

If we have 3 rules added in the configuration (R1, R2, R3) and we are getting 429 or 500 errors in R2. Will my integration stop fetching the detections or will it fetch detections of rule R3?

Case #1: When HTTP 429 or 500 error resumes before 60 retry attempts

• System will re-attempt to fetch the detection after 1 min for the same R2 rule. The system will re-attempt to get the detections for Rule R2, 60 times.
  If 429 or 500 error is recovered before 60 attempts, the system will fetch the detections for Rule R2 and then proceed ahead for Rule R3.

Case #2: When HTTP 429 or 500 error does not resume for 60 retry attempts

• System will re-attempt after 1 min for the same R2 rule. The system will re-attempt to get the detections for Rule R2 60 times.
  If 429 error does not recover for 60 attempts, the system will skip Rule R2 and then proceed ahead for rule R3 to fetch its detections by adding a log.

Question #2

What if R1 is an invalid rule id? Would it be able to fetch R2 and R3 detections?

• There will not be any retry attempts for invalid rule ids. The system will skip the invalid rule ids and move to the next rule id. So if R1 is invalid, the system will skip it without any retry attempts and move to R2.

Question #3

What if R1 is deleted rule id? Would it be able to fetch R2 and R3 detections?

• There will not be any retry attempts for deleted rule ids. The system will skip the deleted rule ids and move to the next rule id. So if R1 is deleted, the system will skip it without any retry attempts and move to R2.

Configure Chronicle on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for Chronicle.
3. Click Add instance to create and configure a new integration instance.
   • Name: a textual name for the integration instance.
   • User’s Service Account JSON
   • Region: Select the region based on the location of the chronicle backstory instance. If region is not listed in the dropdown, choose the “Other” option and specify the region in the “Other Region” text field.
   • Other Region: Specify the region based on the location of the chronicle backstory instance. Only applicable if the “Other” option is selected in the Region dropdown.
   • Provide comma(‘,’) separated categories (e.g. APT-Activity, Phishing). Indicators belonging to these “categories” would be considered as “malicious” when executing reputation commands.
   • Provide comma(‘,’) separated categories (e.g. Unwanted, VirusTotal YARA Rule Match). Indicators belonging to these “categories” would be considered as “suspicious” when executing reputation commands.
   • Specify the “severity” of indicator that should be considered as “malicious” irrespective of the category. If you wish to consider all indicators with High severity as Malicious, set this parameter to ‘High’. Allowed values are ‘High’, ‘Medium’ and ‘Low’. This configuration is applicable to reputation commands only.
   • Specify the “severity” of indicator that should be considered as “suspicious” irrespective of the category. If you wish to consider all indicators with Medium severity as Suspicious, set this parameter to ‘Medium’. Allowed values are ‘High’, ‘Medium’ and ‘Low’. This configuration is applicable to reputation commands only.
   • Specify the numeric value of “confidence score”. If the indicator’s confidence score is equal or above the configured threshold, it would be considered as “malicious”. The value provided should be greater than the suspicious threshold. This configuration is applicable to reputation commands only.
   • Specify the numeric value of “confidence score”. If the indicator’s confidence score is equal or above the configured threshold, it would be considered as “suspicious”. The value provided should be smaller than the malicious threshold. This configuration is applicable to reputation commands only.
   • Select the confidence score level. If the indicator’s confidence score level is equal or above the configured level, it would be considered as “malicious”. The confidence level configured should have higher precedence than the suspicious level. This configuration is applicable to reputation commands only. Refer the “confidence score” level precedence UNKNOWN_SEVERITY < INFORMATIONAL < LOW < MEDIUM < HIGH.
   • Select the confidence score level. If the indicator’s confidence score level is equal or above the configured level, it would be considered as “suspicious”. The confidence level configured should have lesser precedence than the malicious level. This configuration is applicable to reputation commands only. Refer the “confidence score” level precedence UNKNOWN_SEVERITY < INFORMATIONAL < LOW < MEDIUM < HIGH.
   • Fetches incidents
   • First fetch time
   • How many incidents to fetch each time
   • Chronicle Alert Type (Select the type of data to consider for fetch incidents)
   • Time window (in minutes)
   • Select the severity of alerts to be filtered for Fetch Incidents. Available options are ‘High’, ‘Medium’, ‘Low’ and ‘Unspecified’ (If not selected, fetches all alerts).
   • Detections to fetch by Rule ID or Version ID
   • Fetch all rules detections
   • Filter detections by alert state
   • List Basis
   • Trust any certificate (not secure)
   • Use system proxy settings
4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

Fetch-incidents feature can pull events from Google Chronicle which can be converted into actionable incidents for further investigation. It is the function that Cortex XSOAR calls every minute to import new incidents and can be enabled by the “Fetches incidents” parameter in the integration configuration.

Configuration Parameters for Fetch-incidents

• First fetch time interval: Default 3 days
• How many incidents to fetch each time: Default 100
• Select the severity of alerts to be filtered for Fetch Incidents. Available options are ‘High’, ‘Medium’, ‘Low’ and ‘Unspecified’ (If not selected, fetches all alerts). Only applicable for asset alerts.
• Chronicle Alert Type (Select the type of data to consider for fetch incidents):
  • IOC Domain matches Default
  • Assets with alerts
  • Curated Rule Detection alerts
  • Detection alerts
  • User alerts
• Time window (in minutes): Not applicable for IOC Domain matches
  • 15 Default
  • 30
  • 45
  • 60
• Detections to fetch by Rule ID or Version ID Only applicable for Detection alerts and Curated Rule Detection alerts
• Fetch all rules detections Only applicable for Detection alerts
• Filter detections by alert state: Only applicable for Detection alerts and Curated Rule Detection alerts
  • ALERTING
  • NOT ALERTING

Incident field mapping - Asset Alerts

Incident field mapping - IOC Domain matches

Incident field mapping - Detection Alerts

Incident field mapping - Curated Rule Detection alerts

Incident field mapping - User Alerts

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

1. gcb-list-iocs
2. gcb-assets
3. ip
4. domain
5. gcb-ioc-details
6. gcb-list-alerts
7. gcb-list-events
8. gcb-list-detections
9. gcb-list-rules
10. gcb-create-rule
11. gcb-get-rule
12. gcb-delete-rule
13. gcb-create-rule-version
14. gcb-change-rule-alerting-status
15. gcb-change-live-rule-status
16. gcb-start-retrohunt
17. gcb-get-retrohunt
18. gcb-list-retrohunts
19. gcb-cancel-retrohunt
20. gcb-list-reference-list
21. gcb-get-reference-list
22. gcb-create-reference-list
23. gcb-update-reference-list
24. gcb-verify-reference-list
25. gcb-test-rule-stream
26. gcb-list-useraliases
27. gcb-list-assetaliases
28. gcb-list-curatedrules
29. gcb-list-curatedrule-detections
30. gcb-udm-search
31. gcb-verify-value-in-reference-list
32. gcb-verify-rule
33. gcb-get-event
34. gcb-reference-list-append-content
35. gcb-reference-list-remove-content

1. gcb-list-iocs

Lists the IOC Domain matches within your enterprise for the specified time interval. The indicator of compromise (IOC) domain matches lists for which the domains that your security infrastructure has flagged as both suspicious and that have been seen recently within your enterprise.

Base Command

gcb-list-iocs

Input

Context Output

Command Example

!gcb-list-iocs page_size=1 preset_time_range="Last 1 day"

Context Example

{
    "GoogleChronicleBackstory.Iocs": [
        {
            "FirstAccessedTime": "2018-10-03T02:12:51Z", 
            "Sources": [
                {
                    "Category": "Spyware Reporting Server", 
                    "RawSeverity": "Medium", 
                    "NormalizedConfidenceScore": "Low", 
                    "IntRawConfidenceScore": 0, 
                    "Source": "ET Intelligence Rep List"
                }
            ], 
            "LastAccessedTime": "2020-02-14T05:59:27Z", 
            "Artifact": "anx.tb.ask.com", 
            "IocIngestTime": "2020-02-06T22:00:00Z"
        },
        {
            "Artifact": "0.0.0.1",
            "IocIngestTime": "2023-11-30T19:26:41.266555Z",
            "FirstAccessedTime": "2023-01-17T09:54:19Z",
            "LastAccessedTime": "2023-01-17T09:54:19Z",
            "Sources": [
                {
                    "Category": "Unwanted",
                    "IntRawConfidenceScore": 0,
                    "NormalizedConfidenceScore": "Medium",
                    "RawSeverity": "Medium",
                    "Source": "Threat Intelligence"
                }
            ]
        }
    ], 
    "Domain": [
        {
            "Name": "anx.tb.ask.com"
        }
    ]
}

Human Readable Output

IOC Domain Matches

Artifact	Category	Source	Confidence	Severity	IOC ingest time	First seen	Last seen
anx.tb.ask.com	Spyware Reporting Server	ET Intelligence Rep List	Low	Medium	7 days ago	a year ago	3 hours ago
0.0.0.1	Unwanted	Threat Intelligence	Medium	Medium	3 days ago	10 months ago	10 months ago

2. gcb-assets

Returns a list of the assets that accessed the input artifact (IP, domain, MD5, SHA1 and SHA256) during the specified time.

Base Command

gcb-assets

Input

Context Output

Command Example

!gcb-assets artifact_value=bing.com preset_time_range="Last 1 day"

Context Example

{
    "GoogleChronicleBackstory.Asset": [
        {
            "FirstAccessedTime": "2018-10-18T04:38:44Z", 
            "AccessedDomain": "bing.com", 
            "HostName": "james-anderson-laptop", 
            "LastAccessedTime": "2020-02-14T07:13:33Z"
        }, 
        {
            "FirstAccessedTime": "2018-10-18T02:01:51Z", 
            "AccessedDomain": "bing.com", 
            "HostName": "roger-buchmann-pc", 
            "LastAccessedTime": "2020-02-13T22:25:27Z"
        }
    ], 
    "Host": [
        {
            "Hostname": "james-anderson-laptop"
        }, 
        {
            "Hostname": "roger-buchmann-pc"
        }
    ]
}

Human Readable Output

Assets related to artifact - bing.com

Host Name	Host IP	Host MAC	First Accessed Time	Last Accessed Time
james-anderson-laptop	-	-	2018-10-18T04:38:44Z	2020-02-14T07:13:33Z
roger-buchmann-pc	-	-	2018-10-18T02:01:51Z	2020-02-13T22:25:27Z

View assets in Chronicle

3. ip

Checks the reputation of an IP address.

Base Command

ip

Input

Context Output

Command Example

!ip ip=23.20.239.12

Context Example

{
    "IP": {
        "Address": "23.20.239.12"
    }, 
    "DBotScore": {
        "Vendor": "Google Chronicle Backstory", 
        "Indicator": "23.20.239.12", 
        "Score": 0, 
        "Type": "ip"
    }, 
    "GoogleChronicleBackstory.IP": {
        "Sources": [
            {
                "Category": "Known CnC for Mobile specific Family", 
                "FirstAccessedTime": "2018-12-05T00:00:00Z", 
                "Severity": "High", 
                "ConfidenceScore": 70, 
                "Address": [
                    {
                        "IpAddress": "23.20.239.12", 
                        "Port": [
                            80
                        ]
                    }
                ], 
                "LastAccessedTime": "2019-04-10T00:00:00Z"
            }, 
            {
                "Category": "Blocked", 
                "FirstAccessedTime": "1970-01-01T00:00:00Z", 
                "Severity": "High", 
                "ConfidenceScore": "High", 
                "Address": [
                    {
                        "Domain": "mytemplatewebsite.com", 
                        "Port": ""
                    }, 
                    {
                        "IpAddress": "23.20.239.12", 
                        "Port": ""
                    }
                ], 
                "LastAccessedTime": "2020-02-16T08:56:06Z"
            }
        ], 
        "IoCQueried": "23.20.239.12"
    }
}

Human Readable Output

IP: 23.20.239.12 found with Reputation: Unknown

Reputation Parameters

Domain	IP Address	Category	Confidence Score	Severity	First Accessed Time	Last Accessed Time
-	23.20.239.12	Known CnC for Mobile specific Family	70	High	2018-12-05T00:00:00Z	2019-04-10T00:00:00Z
mytemplatewebsite.com	23.20.239.12	Blocked	High	High	1970-01-01T00:00:00Z	2020-02-16T08:56:06Z

View IoC details in Chronicle

4. domain

Checks the reputation of a domain.

Base Command

domain

Input

Context Output

Command Example

!domain domain=bing.com

Context Example

{
    "GoogleChronicleBackstory.Domain": {
        "Sources": [
            {
                "Category": "Observed serving executables", 
                "FirstAccessedTime": "2013-08-06T00:00:00Z", 
                "Severity": "Low", 
                "ConfidenceScore": 67, 
                "Address": [
                    {
                        "Domain": "bing.com", 
                        "Port": [
                            80
                        ]
                    }
                ], 
                "LastAccessedTime": "2020-01-14T00:00:00Z"
            }
        ], 
        "IoCQueried": "bing.com"
    }, 
    "Domain": {
        "Name": "bing.com"
    }, 
    "DBotScore": {
        "Vendor": "Google Chronicle Backstory", 
        "Indicator": "bing.com", 
        "Score": 0, 
        "Type": "domain"
    }
}

Human Readable Output

Domain: bing.com found with Reputation: Unknown

Reputation Parameters

Domain	IP Address	Category	Confidence Score	Severity	First Accessed Time	Last Accessed Time
bing.com	-	Observed serving executables	67	Low	2013-08-06T00:00:00Z	2020-01-14T00:00:00Z

View IoC details in Chronicle

5. gcb-ioc-details

Accepts an artifact indicator and returns any threat intelligence associated with the artifact. The threat intelligence information is drawn from your enterprise security systems and from Chronicle’s IoC partners (for example, the DHS threat feed).

Base Command

gcb-ioc-details

Input

Context Output

Command Example

!gcb-ioc-details artifact_value=23.20.239.12

Context Example

{
    "IP": {
        "Address": "23.20.239.12"
    }, 
    "GoogleChronicleBackstory.IocDetails": {
        "Sources": [
            {
                "Category": "Known CnC for Mobile specific Family", 
                "FirstAccessedTime": "2018-12-05T00:00:00Z", 
                "Severity": "High", 
                "ConfidenceScore": 70, 
                "Address": [
                    {
                        "IpAddress": "23.20.239.12", 
                        "Port": [
                            80
                        ]
                    }
                ], 
                "LastAccessedTime": "2019-04-10T00:00:00Z"
            }, 
            {
                "Category": "Blocked", 
                "FirstAccessedTime": "1970-01-01T00:00:00Z", 
                "Severity": "High", 
                "ConfidenceScore": "High", 
                "Address": [
                    {
                        "Domain": "mytemplatewebsite.com", 
                        "Port": ""
                    }, 
                    {
                        "IpAddress": "23.20.239.12", 
                        "Port": ""
                    }
                ], 
                "LastAccessedTime": "2020-02-16T08:56:06Z"
            }
        ], 
        "IoCQueried": "23.20.239.12"
    }
}

Human Readable Output

IoC Details

Domain	IP Address	Category	Confidence Score	Severity	First Accessed Time	Last Accessed Time
-	23.20.239.12	Known CnC for Mobile specific Family	70	High	2018-12-05T00:00:00Z	2019-04-10T00:00:00Z
mytemplatewebsite.com	23.20.239.12	Blocked	High	High	1970-01-01T00:00:00Z	2020-02-16T08:56:06Z

View IoC details in Chronicle

6. gcb-list-alerts

List all the alerts tracked within your enterprise for the specified time range. Both the parsed alerts and their corresponding raw alert logs are returned.

Base Command

gcb-list-alerts

Input

Context Output

Command Example

!gcb-list-alerts page_size=1 preset_time_range="Last 1 day"

Context Example

{
    "GoogleChronicleBackstory.Alert": [
        {
            "AssetName": "rosie-hayes-pc", 
            "AlertInfo": [
                {
                    "Timestamp": "2020-02-14T03:02:36Z", 
                    "SourceProduct": "Internal Alert", 
                    "Name": "Authentication failure [32038]", 
                    "Severity": "Medium"
                }
            ], 
            "AlertCounts": 1
        }
    ]
}

Human Readable Output

Security Alert(s)

Alerts	Asset	Alert Names	First Seen	Last Seen	Severities	Sources
1	rosie-hayes-pc	Authentication failure [32038]	6 hours ago	6 hours ago	Medium	Internal Alert

7. gcb-list-events

List all of the events discovered within your enterprise on a particular device within the specified time range. If you receive the maximum number of events you specified using the page_size parameter (or 100, the default), there might still be more events within your Chronicle account. You can narrow the time range and issue the call again to ensure you have visibility into all possible events. This command returns more than 60 different types of events. Any event would have only specific output context set. Refer the UDM documentation to figure out the output properties specific to the event types.

Base Command

gcb-list-events

Input

Context Output

Command Example

!gcb-list-events asset_identifier_type="Host Name" asset_identifier="ray-xxx-laptop" start_time="2020-01-01T00:00:00Z" page_size="1"

Context Example

{
    "GoogleChronicleBackstory.Events": [
        {
            "principal": {
                "ip": [
                    "10.0.XX.XX"
                ], 
                "mac": [
                    "88:a6:XX:XX:XX:XX"
                ], 
                "hostname": "ray-xxx-laptop"
            }, 
            "target": {
                "ip": [
                    "8.8.8.8"
                ]
            }, 
            "network": {
                "applicationProtocol": "DNS", 
                "dns": {
                    "questions": [
                        {
                            "type": 1, 
                            "name": "is5-ssl.mzstatic.com"
                        }
                    ], 
                    "answers": [
                        {
                            "type": 1, 
                            "data": "104.118.212.43", 
                            "name": "is5-ssl.mzstatic.com", 
                            "ttl": 11111
                        }
                    ], 
                    "response": true
                }
            }, 
            
            "collectedTimestamp": "2020-01-02T00:00:00Z", 
            "productName": "ExtraHop", 
            "eventTimestamp": "2020-01-01T23:59:38Z", 
            "eventType": "NETWORK_DNS"
        
        }
    ]
}

Human Readable Output

Event(s) Details

Event Timestamp	Event Type	Principal Asset Identifier	Target Asset Identifier	Queried Domain
2020-01-01T23:59:38Z	NETWORK_DNS	ray-xxx-laptop	8.8.8.8	ninthdecimal.com

View events in Chronicle

Maximum number of events specified in page_size has been returned. There might still be more events in your Chronicle account. To fetch the next set of events, execute the command with the start time as 2020-01-01T23:59:38Z

8. gcb-list-detections

Return the detections for the specified version of a rule, the latest version of a rule, all versions of a rule, or all versions of all rules.

Base Command

gcb-list-detections

Input

Context Output

Command Example

!gcb-list-detections id=ru_746bd6d6-6b84-4007-b74c-ec90c7306a71 page_size=2

Context Example

{
    "GoogleChronicleBackstory": {
        "Detections": [
            {
                "alertState": "NOT_ALERTING",
                "collectionElements": [
                    {
                        "label": "event",
                        "references": [
                            {
                                "eventTimestamp": "2020-12-24T03:00:02.559Z",
                                "eventType": "NETWORK_DNS",
                                "ingestedTimestamp": "2020-12-24T03:03:17.129868Z",
                                "network": {
                                    "applicationProtocol": "DNS",
                                    "dns": {
                                        "questions": [
                                            {
                                                "name": "is5-ssl.mzstatic.com",
                                                "type": 1
                                            }
                                        ]
                                    }
                                },
                                "principal": {
                                    "hostname": "ray-xxx-laptop",
                                    "ip": [
                                        "10.0.XX.XX"
                                    ],
                                    "mac": [
                                        "88:a6:XX:XX:XX:XX"
                                    ]
                                },
                                "principalAssetIdentifier": "ray-xxx-laptop",
                                "productName": "ExtraHop",
                                "securityResult": [
                                    {
                                        "action": [
                                            "UNKNOWN_ACTION"
                                        ]
                                    }
                                ],
                                "target": {
                                    "ip": [
                                        "10.0.XX.XX"
                                    ]
                                },
                                "targetAssetIdentifier": "10.0.XX.XX"
                            },
                            {
                                "eventTimestamp": "2020-12-24T03:00:40.566Z",
                                "eventType": "NETWORK_DNS",
                                "ingestedTimestamp": "2020-12-24T03:03:17.129868Z",
                                "network": {
                                    "applicationProtocol": "DNS",
                                    "dns": {
                                        "questions": [
                                            {
                                                "name": "is5-ssl.mzstatic.com",
                                                "type": 1
                                            }
                                        ]
                                    }
                                },
                                "principal": {
                                    "hostname": "ray-xxx-laptop",
                                    "ip": [
                                        "10.0.XX.XX"
                                    ],
                                    "mac": [
                                        "88:a6:XX:XX:XX:XX"
                                    ]
                                },
                                "principalAssetIdentifier": "ray-xxx-laptop",
                                "productName": "ExtraHop",
                                "securityResult": [
                                    {
                                        "action": [
                                            "UNKNOWN_ACTION"
                                        ]
                                    }
                                ],
                                "target": {
                                    "ip": [
                                        "10.0.XX.XX"
                                    ]
                                },
                                "targetAssetIdentifier": "10.0.XX.XX"
                            }
                        ]
                    }
                ],
                "createdTime": "2020-12-24T03:13:46.116199Z",
                "detectionFields": [
                    {
                        "key": "client_ip",
                        "value": "10.0.XX.XX"
                    }
                ],
                "detectionTime": "2020-12-24T04:00:00Z",
                "id": "de_bea17243-d3b3-14bf-6b57-74e1a2422c68",
                "ruleId": "ru_746bd6d6-6b84-4007-b74c-ec90c7306a71",
                "ruleName": "SampleRule",
                "ruleType": "MULTI_EVENT",
                "ruleVersion": "ru_746bd6d6-6b84-4007-b74c-ec90c7306a71@v_1604081489_593503000",
                "timeWindowEndTime": "2020-12-24T04:00:00Z",
                "timeWindowStartTime": "2020-12-24T03:00:00Z",
                "type": "RULE_DETECTION",
                "urlBackToProduct": "https://dummy-chronicle/alert?alertId=de_bea17243-d3b3-14bf-6b57-74e1a2422c68"
            },
            {
                "alertState": "NOT_ALERTING",
                "collectionElements": [
                   {
                        "label": "event",
                        "references": [
                            {
                                "eventTimestamp": "2020-12-24T03:00:11.959Z",
                                "eventType": "NETWORK_DNS",
                                "ingestedTimestamp": "2020-12-24T03:03:17.200062Z",
                                "network": {
                                    "applicationProtocol": "DNS",
                                    "dns": {
                                        "answers": [
                                            {
                                                "data": "10.0.XX.XX",
                                                "name": "is5-ssl.mzstatic.com",
                                                "ttl": 11111,
                                                "type": 1
                                            }
                                        ],
                                        "questions": [
                                            {
                                                "name": "is5-ssl.mzstatic.com",
                                                "type": 1
                                            }
                                        ],
                                        "response": true
                                    }
                                },
                                "principal": {
                                    "hostname": "ray-xxx-laptop",
                                    "ip": [
                                        "10.0.XX.XX"
                                    ],
                                    "mac": [
                                        "88:a6:XX:XX:XX:XX"
                                    ]
                                },
                                "principalAssetIdentifier": "ray-xxx-laptop",
                                "productName": "ExtraHop",
                                "securityResult": [
                                    {
                                        "action": [
                                            "UNKNOWN_ACTION"
                                        ]
                                    }
                                ],
                                "target": {
                                    "ip": [
                                        "10.0.XX.XX"
                                    ]
                                },
                                "targetAssetIdentifier": "10.0.XX.XX"
                            },
                            {
                                "eventTimestamp": "2020-12-24T03:01:43.953Z",
                                "eventType": "NETWORK_DNS",
                                "ingestedTimestamp": "2020-12-24T03:03:17.200062Z",
                                "network": {
                                    "applicationProtocol": "DNS",
                                    "dns": {
                                        "answers": [
                                            {
                                                "data": "10.0.XX.XX",
                                                "name": "is5-ssl.mzstatic.com",
                                                "ttl": 11111,
                                                "type": 1
                                            }
                                        ],
                                        "questions": [
                                            {
                                                "name": "is5-ssl.mzstatic.com",
                                                "type": 1
                                            }
                                        ],
                                        "response": true
                                    }
                                },
                                "principal": {
                                    "hostname": "ray-xxx-laptop",
                                    "ip": [
                                        "10.0.XX.XX"
                                    ],
                                    "mac": [
                                        "88:a6:XX:XX:XX:XX"
                                    ]
                                },
                                "principalAssetIdentifier": "ray-xxx-laptop",
                                "productName": "ExtraHop",
                                "securityResult": [
                                    {
                                        "action": [
                                            "UNKNOWN_ACTION"
                                        ]
                                    }
                                ],
                                "target": {
                                    "ip": [
                                        "10.0.XX.XX"
                                    ]
                                },
                                "targetAssetIdentifier": "10.0.XX.XX"
                            }
                        ]
                   }
                ],
                "createdTime": "2020-12-24T03:13:46.449491Z",
                "detectionFields": [
                    {
                        "key": "client_ip",
                        "value": "10.0.XX.XX"
                    }
                ],
                "detectionTime": "2020-12-24T04:00:00Z",
                "id": "de_d6194710-acd4-c1de-e440-d1c6a7a50fc1",
                "ruleId": "ru_746bd6d6-6b84-4007-b74c-ec90c7306a71",
                "ruleName": "SampleRule",
                "ruleType": "MULTI_EVENT",
                "ruleVersion": "ru_746bd6d6-6b84-4007-b74c-ec90c7306a71@v_1604081489_593503000",
                "timeWindowEndTime": "2020-12-24T04:00:00Z",
                "timeWindowStartTime": "2020-12-24T03:00:00Z",
                "type": "RULE_DETECTION",
                "urlBackToProduct": "https://dummy-chronicle/alert?alertId=de_d6194710-acd4-c1de-e440-d1c6a7a50fc1"
            }
        ],
        "Token": {
            "name": "gcb-list-detections",
            "nextPageToken": "foobar_page_token"
        }
    }
}

Human Readable Output

Detection(s) Details For Rule: SampleRule

Detection ID	Detection Type	Detection Time	Events	Alert State
de_bea17243-d3b3-14bf-6b57-74e1a2422c68	RULE_DETECTION	2020-12-24T04:00:00Z	Event Timestamp: 2020-12-24T03:00:02.559Z Event Type: NETWORK_DNS Principal Asset Identifier: ray-xxx-laptop Target Asset Identifier: 10.0.XX.XX Queried Domain: is5-ssl.mzstatic.com Event Timestamp: 2020-12-24T03:00:40.566Z Event Type: NETWORK_DNS Principal Asset Identifier: ray-xxx-laptop Target Asset Identifier: 10.0.XX.XX Queried Domain: is5-ssl.mzstatic.com	NOT_ALERTING
de_d6194710-acd4-c1de-e440-d1c6a7a50fc1	RULE_DETECTION	2020-12-24T04:00:00Z	Event Timestamp: 2020-12-24T03:00:11.959Z Event Type: NETWORK_DNS Principal Asset Identifier: ray-xxx-laptop Target Asset Identifier: 10.0.XX.XX Queried Domain: is5-ssl.mzstatic.com Event Timestamp: 2020-12-24T03:01:43.953Z Event Type: NETWORK_DNS Principal Asset Identifier: ray-xxx-laptop Target Asset Identifier: 10.0.XX.XX Queried Domain: is5-ssl.mzstatic.com	NOT_ALERTING

View all detections for this rule in Chronicle by clicking on SampleRule and to view individual detection in Chronicle click on its respective Detection ID.

Note: If a specific version of the rule is provided then detections for that specific version will be fetched.
Maximum number of detections specified in page_size has been returned. To fetch the next set of detections, execute the command with the page token as foobar_page_token.

9. gcb-list-rules

List the latest versions of all Rules.

Base Command

gcb-list-rules

Input

Context Output

Command Example

!gcb-list-rules page_size=2

Context Example

{
    "GoogleChronicleBackstory": {
       "rules": [
          {
             "ruleId": "ru_c5b129e4-9e20-44ad-ad23-78117bd2a2af",
             "versionId": "ru_c5b129e4-9e20-44ad-ad23-78117bd2a2af@v_1614773287_876527000",
             "ruleName": "malicious_extensions",
             "metadata": {
                "author": "analyst5",
                "description": "Use to detects malicious extentions from email attachments.",
                "severity": "High"
             },
             "ruleText": "rule malicious_extensions {\n  meta:\n    author = \"analyst5\"\n    description = \"Use to detects malicious extentions from email attachments.\"\n    severity = \"High\"\n\n  events:\n    $event.metadata.event_type = \"EMAIL_TRANSACTION\"\n    $event.about.file.mime_type = /^.*\\.(com|exe|bat|cmd|cpl|jar|js|msi|rar|reg)$/\n\n  condition:\n      $event\n    \n}\n",
             "alertingEnabled": true,
             "versionCreateTime": "2021-03-03T12:08:07.876527Z",
             "compilationState": "SUCCEEDED"
          },
          {
             "ruleId": "ru_d63cfaeb-23d7-4e0a-b342-5f880f6129f9",
             "versionId": "ru_d63cfaeb-23d7-4e0a-b342-5f880f6129f9@v_1614369854_162095000",
             "ruleName": "empire_monkey",
             "metadata": {
                "version": "0.01",
                "created": "2019/04/02",
                "category": "process_creation",
                "product": "windows",
                "mitre": "t1086, execution",
                "author": "Marcus Testman",
                "description": "Detects EmpireMonkey APT reported Activity  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md.",
                "reference": "https://tdm.socprime.com/tdm/info/jFbYfF51ECXh"
             },
             "ruleText": "rule empire_monkey {\n\tmeta:\n\t\tauthor = \"Marcus Testman\"\n\t\tdescription = \"Detects EmpireMonkey APT reported Activity  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md.\"\n\t\treference = \"https://tdm.socprime.com/tdm/info/jFbYfF51ECXh\"\n\t\tversion = \"0.01\"\n\t\tcreated = \"2019/04/02\"\n\t\tcategory = \"process_creation\"\n\t\tproduct = \"windows\"\n\t\tmitre = \"t1086, execution\"\n\n\tevents:\n(re.regex($selection_cutil.target.process.command_line, `.*/i:%APPDATA%\\\\logs\\.txt scrobj\\.dll`) and (re.regex($selection_cutil.target.process.file.full_path, `.*\\\\cutil\\.exe`) or $selection_cutil.metadata.description = \"Microsoft(C) Registerserver\"))\n\n\tcondition:\n\t\t$selection_cutil\n}\n",
             "versionCreateTime": "2021-02-26T20:04:14.162095Z",
             "compilationState": "SUCCEEDED"
          }
       ],
       "nextPageToken": "foobar_page_token"
    }
}

Human Readable Output

Rule(s) Details

Rule ID	Rule Name	Compilation State
ru_42f02f52-544c-4b6e-933c-df17648d5831	email_execution	SUCCEEDED
ru_f13faad1-0041-476c-a05a-40e01c942796	rule_1616480950177	SUCCEEDED

Maximum number of rules specified in page_size has been returned. To fetch the next set of detections, execute the command with the page token as foobar_page_token.

10. gcb-create-rule

Creates a new rule. By default the live rule status will be set to disabled.

Base Command

gcb-create-rule

Input

Context Output

Command Example

!gcb-create-rule rule_text="rule demoRuleCreatedFromAPI {meta: author = \"securityuser\" description = \"single event rule that should generate detections\" events: $e.metadata.event_type = \"NETWORK_DNS\" condition: $e}"

Context Example

{
    "GoogleChronicleBackstory": {
        "Rules": {
            "compilationState": "SUCCEEDED",
            "metadata": {
                "author": "securityuser",
                "description": "single event rule that should generate detections"
            },
            "ruleId": "ru_b28005ec-e027-4300-9dcc-0c6ef5dda8e6",
            "ruleName": "demoRuleCreatedFromAPI",
            "ruleText": "rule demoRuleCreatedFromAPI {meta: author = \"securityuser\" description = \"single event rule that should generate detections\" events: $e.metadata.event_type = \"NETWORK_DNS\" condition: $e}\n",
            "ruleType": "SINGLE_EVENT",
            "versionCreateTime": "2022-06-23T06:21:36.217135Z",
            "versionId": "ru_b28005ec-e027-4300-9dcc-0c6ef5dda8e6@v_1655965296_217135000"
        }
    }
}

Human Readable Output

Rule Detail

Rule ID	Version ID	Author	Rule Name	Description	Version Creation Time	Compilation Status	Rule Text
ru_b28005ec-e027-4300-9dcc-0c6ef5dda8e6	ru_b28005ec-e027-4300-9dcc-0c6ef5dda8e6@v_1655965296_217135000	securityuser	demoRuleCreatedFromAPI	single event rule that should generate detections	2022-06-23T06:21:36.217135Z	SUCCEEDED	rule demoRuleCreatedFromAPI {meta: author = “securityuser” description = “single event rule that should generate detections” events: $e.metadata.event_type = “NETWORK_DNS” condition: $e}

11. gcb-get-rule

Retrieves the rule details of specified Rule ID or Version ID.

Base Command

gcb-get-rule

Input

Context Output

Command Example

!gcb-get-rule id=ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7

Context Example

{
    "GoogleChronicleBackstory": {
        "Rules": {
            "compilationState": "SUCCEEDED",
            "metadata": {
                "author": "securityuser",
                "description": "single event rule that should generate detections"
            },
            "ruleId": "ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7",
            "ruleName": "demoRuleCreatedFromAPI",
            "ruleText": "rule demoRuleCreatedFromAPI {meta: author = \"securityuser\" description = \"single event rule that should generate detections\" events: $e.metadata.event_type = \"NETWORK_DNS\" condition: $e}\n",
            "ruleType": "SINGLE_EVENT",
            "versionCreateTime": "2022-06-22T13:28:20.905647Z",
            "versionId": "ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7@v_1655904500_905647000"
        }
    }
}

Human Readable Output

Rule Details

Rule ID	Version ID	Author	Rule Name	Description	Version Creation Time	Compilation Status	Rule Text
ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7	ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7@v_1655904500_905647000	securityuser	demoRuleCreatedFromAPI	single event rule that should generate detections	2022-06-22T13:28:20.905647Z	SUCCEEDED	rule demoRuleCreatedFromAPI {meta: author = “securityuser” description = “single event rule that should generate detections” events: $e.metadata.event_type = “NETWORK_DNS” condition: $e}

12. gcb-delete-rule

Deletes the rule specified by Rule ID.

Base Command

gcb-delete-rule

Input

Context Output

Command Example

!gcb-delete-rule rule_id=ru_1e0b123a-5ad8-47d1-94fb-0b874a526f9b

Context Example

{
    "GoogleChronicleBackstory": {
        "DeleteRule": {
            "actionStatus": "SUCCESS",
            "ruleId": "ru_1e0b123a-5ad8-47d1-94fb-0b874a526f9b"
        }
    }
}

Human Readable Output

Rule with ID ru_1e0b123a-5ad8-47d1-94fb-0b874a526f9b deleted successfully

Rule ID	Action Status
ru_1e0b123a-5ad8-47d1-94fb-0b874a526f9b	SUCCESS

13. gcb-create-rule-version

Creates a new version of an existing rule.

Base Command

gcb-create-rule-version

Input

Context Output

Command Example

!gcb-create-rule-version rule_id=ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7 rule_text="rule demoRuleCreatedFromAPI {meta: author = \"securityuser\" description = \"single event rule that should generate detections\" events: $e.metadata.event_type = \"NETWORK_DNS\" condition: $e}"

Context Example

{
    "GoogleChronicleBackstory": {
        "Rules": {
            "compilationState": "SUCCEEDED",
            "metadata": {
                "author": "securityuser",
                "description": "single event rule that should generate detections"
            },
            "ruleId": "ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7",
            "ruleName": "demoRuleCreatedFromAPI",
            "ruleText": "rule demoRuleCreatedFromAPI {meta: author = \"securityuser\" description = \"single event rule that should generate detections\" events: $e.metadata.event_type = \"NETWORK_DNS\" condition: $e}\n",
            "ruleType": "SINGLE_EVENT",
            "versionCreateTime": "2022-06-23T06:22:15.343423Z",
            "versionId": "ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7@v_1655965335_343423000"
        }
    }
}

Human Readable Output

New Rule Version Details

Rule ID	Version ID	Author	Rule Name	Description	Version Creation Time	Compilation Status	Rule Text
ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7	ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7@v_1655965335_343423000	securityuser	demoRuleCreatedFromAPI	single event rule that should generate detections	2022-06-23T06:22:15.343423Z	SUCCEEDED	rule demoRuleCreatedFromAPI {meta: author = “securityuser” description = “single event rule that should generate detections” events: $e.metadata.event_type = “NETWORK_DNS” condition: $e}

14. gcb-change-rule-alerting-status

Updates the alerting status for a rule specified by Rule ID.

Base Command

gcb-change-rule-alerting-status

Input

Context Output

Command Example

!gcb-change-rule-alerting-status alerting_status=enable rule_id=ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7

Context Example

{
    "GoogleChronicleBackstory": {
        "RuleAlertingChange": {
            "actionStatus": "SUCCESS",
            "alertingStatus": "enable",
            "ruleId": "ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7"
        }
    }
}

Human Readable Output

Alerting Status

Alerting status for the rule with ID ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7 has been successfully enabled.

Rule ID	Action Status
ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7	SUCCESS

15. gcb-change-live-rule-status

Updates the live rule status for a rule specified by Rule ID.

Base Command

gcb-change-live-rule-status

Input

Context Output

Command Example

!gcb-change-live-rule-status live_rule_status=enable rule_id=ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7

Context Example

{
    "GoogleChronicleBackstory": {
        "LiveRuleStatusChange": {
            "actionStatus": "SUCCESS",
            "liveRuleStatus": "enable",
            "ruleId": "ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7"
        }
    }
}

Human Readable Output

Live Rule Status

Live rule status for the rule with ID ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7 has been successfully enabled.

Rule ID	Action Status
ru_99bfa421-2bf2-4440-9ac8-6b1acab170e7	SUCCESS

16. gcb-start-retrohunt

Initiate a retrohunt for the specified rule.

Base Command

gcb-start-retrohunt

Input

Context Output

Command Example

!gcb-start-retrohunt rule_id=ru_4bec682c-305a-40a9-bbc6-81fa5487cb49 start_time="52 weeks"

Context Example

{
    "GoogleChronicleBackstory": {
        "RetroHunt": {
            "eventEndTime": "2022-06-16T06:58:19.994598Z",
            "eventStartTime": "2021-06-17T07:08:19.991404Z",
            "retrohuntId": "oh_4c02f3a7-fe3c-49a0-82ba-ab255dd87723",
            "retrohuntStartTime": "2022-06-16T07:08:21.958022Z",
            "ruleId": "ru_4bec682c-305a-40a9-bbc6-81fa5487cb49",
            "state": "RUNNING",
            "versionId": "ru_4bec682c-305a-40a9-bbc6-81fa5487cb49@v_1655362604_042191000"
        }
    }
}

Human Readable Output

Retrohunt Details

Retrohunt ID	Rule ID	Version ID	Event Start Time	Event End Time	Retrohunt Start Time	State
oh_4c02f3a7-fe3c-49a0-82ba-ab255dd87723	ru_4bec682c-305a-40a9-bbc6-81fa5487cb49	ru_4bec682c-305a-40a9-bbc6-81fa5487cb49@v_1655362604_042191000	2021-06-17T07:08:19.991404Z	2022-06-16T06:58:19.994598Z	2022-06-16T07:08:21.958022Z	RUNNING

17. gcb-get-retrohunt

Get retrohunt for a specific version of rule.

Base Command

gcb-get-retrohunt

Input

Context Output

Command Example

!gcb-get-retrohunt id=ru_7ba19ccc-be0d-40d3-91dc-ab3c41251818 retrohunt_id=oh_cbb6b859-5c9d-4af9-8d74-1a58321078ad

Context Example

{
    "GoogleChronicleBackstory": {
        "RetroHunt": {
            "eventEndTime": "2022-06-15T13:03:06.834384Z",
            "eventStartTime": "2022-06-08T13:03:04.793333Z",
            "progressPercentage": 100,
            "retrohuntEndTime": "2022-06-15T13:05:46.894926Z",
            "retrohuntId": "oh_cbb6b859-5c9d-4af9-8d74-1a58321078ad",
            "retrohuntStartTime": "2022-06-15T13:05:12.774180Z",
            "ruleId": "ru_7ba19ccc-be0d-40d3-91dc-ab3c41251818",
            "state": "DONE",
            "versionId": "ru_7ba19ccc-be0d-40d3-91dc-ab3c41251818@v_1655291303_302767000"
        }
    }
}

Human Readable Output

Retrohunt Details

Retrohunt ID	Rule ID	Version ID	Event Start Time	Event End Time	Retrohunt Start Time	Retrohunt End Time	State	Progress Percentage
oh_cbb6b859-5c9d-4af9-8d74-1a58321078ad	ru_7ba19ccc-be0d-40d3-91dc-ab3c41251818	ru_7ba19ccc-be0d-40d3-91dc-ab3c41251818@v_1655291303_302767000	2022-06-08T13:03:04.793333Z	2022-06-15T13:03:06.834384Z	2022-06-15T13:05:12.774180Z	2022-06-15T13:05:46.894926Z	DONE	100

18. gcb-list-retrohunts

List retrohunts for a rule.

Base Command

gcb-list-retrohunts

Input

Context Output

Command Example

!gcb-list-retrohunts page_size=3

Context Example

{
    "GoogleChronicleBackstory": {
        "RetroHunt": [
            {
                "eventEndTime": "2022-06-16T06:58:19.994598Z",
                "eventStartTime": "2021-06-17T07:08:19.991404Z",
                "progressPercentage": 6.59,
                "retrohuntId": "oh_4c02f3a7-fe3c-49a0-82ba-ab255dd87723",
                "retrohuntStartTime": "2022-06-16T07:08:21.958022Z",
                "ruleId": "ru_4bec682c-305a-40a9-bbc6-81fa5487cb49",
                "state": "RUNNING",
                "versionId": "ru_4bec682c-305a-40a9-bbc6-81fa5487cb49@v_1655362604_042191000"
            },
            {
                "eventEndTime": "2022-06-01T11:00:00Z",
                "eventStartTime": "2020-11-25T11:00:00Z",
                "progressPercentage": 6.69,
                "retrohuntEndTime": "2022-06-16T07:08:35.116493Z",
                "retrohuntId": "oh_5fd39b3d-5814-4ce3-ad4f-244aa943d020",
                "retrohuntStartTime": "2022-06-16T07:06:57.738997Z",
                "ruleId": "ru_4bec682c-305a-40a9-bbc6-81fa5487cb49",
                "state": "CANCELLED",
                "versionId": "ru_4bec682c-305a-40a9-bbc6-81fa5487cb49@v_1655362604_042191000"
            },
            {
                "eventEndTime": "2022-06-16T06:47:45.116641Z",
                "eventStartTime": "2021-06-17T06:57:45.113155Z",
                "progressPercentage": 85.44,
                "retrohuntId": "oh_93cedd70-a6b6-480a-8d78-a894aff43e05",
                "retrohuntStartTime": "2022-06-16T06:57:47.233306Z",
                "ruleId": "ru_4bec682c-305a-40a9-bbc6-81fa5487cb49",
                "state": "RUNNING",
                "versionId": "ru_4bec682c-305a-40a9-bbc6-81fa5487cb49@v_1655362604_042191000"
            }
        ],
        "nextPageToken": "dummy-token"
    }
}

Human Readable Output

Retrohunt Details

Retrohunt ID	Rule ID	Version ID	Event Start Time	Event End Time	Retrohunt Start Time	Retrohunt End Time	State	Progress Percentage
oh_4c02f3a7-fe3c-49a0-82ba-ab255dd87723	ru_4bec682c-305a-40a9-bbc6-81fa5487cb49	ru_4bec682c-305a-40a9-bbc6-81fa5487cb49@v_1655362604_042191000	2021-06-17T07:08:19.991404Z	2022-06-16T06:58:19.994598Z	2022-06-16T07:08:21.958022Z		RUNNING	6.59
oh_5fd39b3d-5814-4ce3-ad4f-244aa943d020	ru_4bec682c-305a-40a9-bbc6-81fa5487cb49	ru_4bec682c-305a-40a9-bbc6-81fa5487cb49@v_1655362604_042191000	2020-11-25T11:00:00Z	2022-06-01T11:00:00Z	2022-06-16T07:06:57.738997Z	2022-06-16T07:08:35.116493Z	CANCELLED	6.69
oh_93cedd70-a6b6-480a-8d78-a894aff43e05	ru_4bec682c-305a-40a9-bbc6-81fa5487cb49	ru_4bec682c-305a-40a9-bbc6-81fa5487cb49@v_1655362604_042191000	2021-06-17T06:57:45.113155Z	2022-06-16T06:47:45.116641Z	2022-06-16T06:57:47.233306Z		RUNNING	85.44

Maximum number of retrohunts specified in page_size has been returned. To fetch the next set of retrohunts, execute the command with the page token as dummy-token

19. gcb-cancel-retrohunt

Cancel a retrohunt for a specified rule.

Base Command

gcb-cancel-retrohunt

Input

Context Output

Command Example

!gcb-cancel-retrohunt id=ru_4bec682c-305a-40a9-bbc6-81fa5487cb49 retrohunt_id=oh_5fd39b3d-5814-4ce3-ad4f-244aa943d020

Context Example

{
    "GoogleChronicleBackstory": {
        "RetroHunt": {
            "cancelled": true,
            "id": "ru_4bec682c-305a-40a9-bbc6-81fa5487cb49",
            "retrohuntId": "oh_5fd39b3d-5814-4ce3-ad4f-244aa943d020"
        }
    }
}

Human Readable Output

Cancelled Retrohunt

Retrohunt for the rule with ID ru_4bec682c-305a-40a9-bbc6-81fa5487cb49 has been successfully cancelled.

ID	Retrohunt ID	Action Status
ru_4bec682c-305a-40a9-bbc6-81fa5487cb49	oh_5fd39b3d-5814-4ce3-ad4f-244aa943d020	SUCCESS

20. gcb-list-reference-list

Retrieve all the reference lists.

Base Command

gcb-list-reference-list

Input

Context Output

Command Example

!gcb-list-reference-list page_size=3

Context Example

{
    "GoogleChronicleBackstory": {
        "ReferenceLists": [
            {
                "createTime": "2022-06-14T06:06:35.787791Z",
                "description": "sample list",
                "contentType": "PLAIN_TEXT",
                "name": "test_1"
            },
            {
                "createTime": "2022-06-15T06:43:45.685951Z",
                "description": "sample list",
                "contentType": "PLAIN_TEXT",
                "name": "Builtin"
            },
            {
                "createTime": "2022-06-14T10:01:23.994415Z",
                "description": "sample",
                "contentType": "PLAIN_TEXT",
                "name": "Certificate_Asset"
            }
        ],
        "nextPageToken": "dummy-token"
    }
}

Human Readable Output

Reference List Details

Name	Content Type	Creation Time	Description
test_1	PLAIN_TEXT	2022-06-14T06:06:35.787791Z	sample list
Builtin	PLAIN_TEXT	2022-06-15T06:43:45.685951Z	sample list
Certificate_Asset	PLAIN_TEXT	2022-06-14T10:01:23.994415Z	sample

Maximum number of reference lists specified in page_size has been returned. To fetch the next set of lists, execute the command with the page token as dummy-token

21. gcb-get-reference-list

Returns the specified list.

Base Command

gcb-get-reference-list

Input

Context Output

Command Example

!gcb-get-reference-list name=test1

Context Example

{
    "GoogleChronicleBackstory": {
        "ReferenceList": {
            "createTime": "2022-06-10T08:59:34.885679Z",
            "description": "update",
            "contentType": "PLAIN_TEXT",
            "lines": [
                "line_item_1",
                "// comment",
                "line_item_2"
            ],
            "name": "test1"
        }
    }
}

Human Readable Output

Reference List Details

Name	Content Type	Description	Creation Time	Content
test1	PLAIN_TEXT	update	2022-06-10T08:59:34.885679Z	line_item_1, // comment, line_item_2

22. gcb-create-reference-list

Create a new reference list.

Base Command

gcb-create-reference-list

Input

Context Output

Command Example

!gcb-create-reference-list description="List created for readme" lines=L1,L2,L3 name=XSOAR_GoogleChronicle_Backstory_README_List_

Context Example

{
    "GoogleChronicleBackstory": {
        "ReferenceList": {
            "createTime": "2022-06-16T07:45:37.285791Z",
            "description": "List created for readme",
            "contentType": "PLAIN_TEXT",
            "lines": [
                "L1",
                "L2",
                "L3"
            ],
            "name": "XSOAR_GoogleChronicle_Backstory_README_List_"
        }
    }
}

Human Readable Output

Reference List Details

Name	Content Type	Description	Creation Time	Content
XSOAR_GoogleChronicle_Backstory_README_List_	PLAIN_TEXT	List created for readme	2022-06-16T07:45:37.285791Z	L1, L2, L3	PLAIN_TEXT

23. gcb-update-reference-list

Updates an existing reference list.

Base Command

gcb-update-reference-list

Input