So I've gotten the Python query up to the point where I can generate a JSON file pulling UDM events from the Tenable log type. I have also incorporated a function that writes the JSON response to a CSV.
Currently though - the query parameters are quite simple:
query = 'metadata.log_type = "TENABLE_IO"'
Where the query seems to be failing is when I go to incorporate statistical functions into my query, specifically:
# Simplified query parameters
query ='''
events:
metadata.log_type = "TENABLE_IO"
$pluginID = security_result.rule_id
$assetID = principal.asset.product_object_id
match:
$pluginID, $assetID
outcome:
$Description = array_distinct(extensions.vulns.vulnerabilities.description)
$FQDN = array_distinct(principal.hostname)
'''
Once the string is run with that query it returns this error:
Error: 400 - {
"error": {
"code": 400,
"message": "generic::invalid_argument: compilation error query uses a feature that is not yet allowed: invalid argument",
"status": "INVALID_ARGUMENT"
}
}
Is this simply a limitation of the current query parameters?
Full python string here:
# Set up API credentials and scopes
SCOPES = ['https://www.googleapis.com/auth/chronicle-backstory']
SERVICE_ACCOUNT_FILE = r'C:\API_keys\OAuth_2_Keys.json'
# Authenticate using the service account key
credentials = service_account.Credentials.from_service_account_file(
SERVICE_ACCOUNT_FILE, scopes=SCOPES
)
http_session = AuthorizedSession(credentials)
# API endpoint
base_url = "https://backstory.googleapis.com/v1/events:udmSearch"
# Simplified query parameters
query ='''
events:
metadata.log_type = "TENABLE_IO"
$pluginID = security_result.rule_id
$assetID = principal.asset.product_object_id
match:
$pluginID, $assetID
outcome:
$Description = array_distinct(extensions.vulns.vulnerabilities.description)
$FQDN = array_distinct(principal.hostname)
'''
start_time = "2024-11-01T00:00:00Z" # Replace with desired start time
end_time = "2024-12-20T01:00:00Z" # Replace with desired end time
limit = 100 # Replace with desired limit
# Build the query string
params = {
"query": query,
"time_range.start_time": start_time,
"time_range.end_time": end_time,
"limit": limit
}
# Encode the query string for the URL (properly handle spaces and special characters)
query_string = urlencode(params)
# Full URL with query parameters
url = f"{base_url}?{query_string}"
# Make the GET request
response = http_session.request("GET", url)
# Function to write JSON response to CSV file
def write_to_csv(json_data, file_path):
if not json_data:
print("No data to write to CSV.")
return
# Extract keys (column names) from the first dictionary in the list
keys = json_data[0].keys()
with open(file_path, 'w', newline='') as file:
writer = csv.DictWriter(file, fieldnames=keys)
writer.writeheader()
writer.writerows(json_data)
# Check the response status and write to CSV
if response.status_code == 200:
response_json = response.json()
# Assuming the response JSON contains a list of events
events = response_json.get('events', [])
csv_file_path = r'C:\temp\Tenable\output1.csv' # Replace with your desired file location
write_to_csv(events, csv_file_path)
print(f"Data written to {csv_file_path}")
else:
print(f"Error: {response.status_code} - {response.text}")
Error: 400 - {
"error": {
"code": 400,
"message": "generic::invalid_argument: compilation error query uses a feature that is not yet allowed: invalid argument",
"status": "INVALID_ARGUMENT"
}
}
LinkedIn
Twitter
