Add parser validation APIs and log-type CLI commands by ishree-dev · Pull Request #201 · google/secops-wrapper

ishree-dev · 2026-03-16T11:32:34Z

This PR introduces new SDK wrapper methods and CLI commands for Chronicle Parser Validation tooling. It specifically adds functionality to trigger GitHub checks for parsers and retrieve their corresponding analysis reports.
Key Changes:

New SDK Methods (src/secops/chronicle/client.py & parser_validation.py):
trigger_github_checks: Triggers a parser analysis report against an associated GitHub PR.
get_analysis_report: Retrieves a completed parser analysis report using its full resource name.
New CLI Commands (src/secops/cli/commands/log_type.py):
- Implemented the secops log-type command group.
- secops log-type trigger-checks --associated-pr --log-type <LOG_TYPE> --customer-id
- secops log-type get-analysis-report --name <REPORT_NAME>
Testing (tests/):
- Added unit tests for the newly added ChronicleClient methods (test_client_parser_validation.py).
- Added unit tests for CLI command handlers (test_log_type.py).
- Added integration tests for the log-type CLI lifecycle (test_log_type_integration.py).
Documentation:
Updated api_module_mapping.md to map logTypes.triggerGitHubChecks and logTypes.getParserAnalysisReport to their respective CLI counterparts.

src/secops/chronicle/client.py

src/secops/chronicle/parser_validation.py

prasoonbirla-google · 2026-03-18T19:41:56Z

src/secops/chronicle/parser_validation.py

+        raise SecOpsError(f"No parsers found for log type: {log_type}")
+
+    # Use the first parser's name (which includes the UUID)
+    parser_name = parsers_data["parsers"][0]["name"]


What's the logic to choose the first parser among multiple?

multiple isnt supported right?

Are we letting the user know about that any how? We should add a log that multiple parsers are not supported if there are instead of directly choosing the first.

I will add the log then

prasoonbirla-google · 2026-03-18T19:58:54Z

src/secops/chronicle/parser_validation.py

+        APIError: If the API request fails.
+    """
+    instance_id = client.instance_id
+    if customer_id and customer_id != client.customer_id:


Can we initialize the client itself with the correct customer id if you're anyway getting it in the argument?

Check if the customer id is already available via the gcloud auth command. In that case no need to provide the customer id separately.

comment resolved

src/secops/chronicle/parser_validation.py

prasoonbirla-google · 2026-03-18T20:05:17Z

src/secops/chronicle/parser_validation.py

+        )
+
+    parsers_data = parsers_resp.json()
+    if not parsers_data.get("parsers"):


If no parser exists for that log type, why are we not triggering the github check api?

comment resolved

prasoonbirla-google · 2026-03-18T20:15:26Z

src/secops/cli/commands/log_type.py

+        result = chronicle.get_analysis_report(name=args.name)
+        output_formatter(result, args.output)
+    except APIError as e:
+        print(f"API error: {e}", file=sys.stderr)


Same comment here.

src/secops/cli/commands/log_type.py

prasoonbirla-google · 2026-03-18T20:17:18Z

tests/chronicle/test_client_parser_validation.py

+
+    result = mock_client.trigger_github_checks(
+        associated_pr="owner/repo/pull/123",
+        log_type="BRO_DNS",


Replace this with DUMMY_LOGTYPE

prasoonbirla-google · 2026-03-18T20:17:33Z

tests/cli/test_log_type.py

+    """Test successful trigger_checks command execution."""
+    args = Namespace(
+        associated_pr="owner/repo/pull/123",
+        log_type="BRO_DNS",


Same comment.

tests/cli/test_log_type_integration.py

prasoonbirla-google · 2026-03-24T09:52:02Z

src/secops/chronicle/parser_validation.py

+    if not isinstance(log_type, str) or len(log_type.strip()) < 2:
+        raise SecOpsError("log_type must be a valid string of length >= 2")
+    if customer_id is not None:
+        if not isinstance(customer_id, str) or len(customer_id.strip()) < 2:


Lets use pattern matching for Customer Id as its a UUID

src/secops/chronicle/parser_validation.py

prasoonbirla-google · 2026-03-26T21:24:27Z

LGTM!

mihirvala08 · 2026-03-31T12:45:23Z

src/secops/chronicle/parser_validation.py

+    # projects/*/locations/*/instances/*/logTypes/*/parsers/<UUID>
+    base_url = client.base_url(version="v1alpha")
+
+    # First get the list of parsers for this log_type to find a valid


Can we not utilize exiting list_parser(https://github.com/google/secops-wrapper/blob/main/src/secops/chronicle/parser.py#L251) instead?

used list_parser

mihirvala08 · 2026-03-31T12:47:13Z

src/secops/chronicle/parser_validation.py

+        "pull_request": associated_pr,
+    }
+
+    response = client.session.post(url, json=payload, timeout=timeout)


Let's utilize chronicle_request utility method (https://github.com/google/secops-wrapper/blob/main/src/secops/chronicle/utils/request_utils.py#L190) to maintain request handling across.

mihirvala08 · 2026-03-31T12:49:26Z

src/secops/chronicle/parser_validation.py

@@ -0,0 +1,159 @@
+# Copyright 2026 Google LLC


These methods seems like good fit to existing parser methods in parser.py.

It would be fine to add/move them into existing module instead of creating new one.

removed parser_validation.py and added the logic in parser.py

ishree-dev requested a review from mihirvala08 as a code owner March 16, 2026 11:32

tarunz reviewed Mar 18, 2026

View reviewed changes

src/secops/chronicle/client.py Outdated Show resolved Hide resolved

prasoonbirla-google reviewed Mar 18, 2026

View reviewed changes

ishree-dev marked this pull request as draft March 20, 2026 07:35

ishree-dev marked this pull request as ready for review March 20, 2026 07:35

ishree-dev force-pushed the cli-changes branch 3 times, most recently from a119b36 to d64e6e4 Compare March 23, 2026 08:10

prasoonbirla-google reviewed Mar 24, 2026

View reviewed changes

ishree-dev force-pushed the cli-changes branch from d64e6e4 to 75b4f4b Compare March 25, 2026 07:54

Adding new APIs in cli

4625c4c

ishree-dev force-pushed the cli-changes branch from 75b4f4b to 4625c4c Compare March 25, 2026 07:57

mihirvala08 reviewed Mar 31, 2026

View reviewed changes

mihirvala08 requested changes Mar 31, 2026

View reviewed changes

mihirvala08 reviewed Mar 31, 2026

View reviewed changes

mihirvala08 linked an issue Apr 1, 2026 that may be closed by this pull request

feat: support for parser validation trigger and report #206

Open

Addressing comments

44fdadf

ishree-dev force-pushed the cli-changes branch from 0e12ec2 to 44fdadf Compare April 1, 2026 10:43

Conversation

ishree-dev commented Mar 16, 2026

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

prasoonbirla-google commented Mar 26, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants