Python Logging Level in Siemplify

[GonFreecss]

Is there a way to set the logging level via a Job/Action (e.g., INFO, DEBUG, ERROR, etc.)?

I understand this convention, but if I don't want to log debug messages, how can I set the level? Thanks!

• siemplify.LOGGER.debug(output_message)
• siemplify.LOGGER.info(output_message)

[dnehoda]

I’m not certain but assume this would be acceptable.  I would need to test in my lab.  However, if you look in the IDE of the component / module where you would like to log - that is where your LOGGER statement would reside. You’ll most likely need to make a copy of the component in question and use that in your configuration.  

[GonFreecss]

I apologize, but I do not understand your reply. I'm asking if there is a syntax for setting the logging level via the logger in Siemplify.

The standard Python logger has several logging levels and allows us to set which levels should be displayed/recorded. When our code is stable, we may decide the debug logs are excessive and set the logger to stop recording these.

Thank you.

[dnehoda]

Yes.  So go into the IDE find the module where you want to log with a specific level and try that configuration.  It’s just basic Python LOGGER commands. 

[GonFreecss]

Sorry if I should have clarified, but I came to the forum because the basic Python LOGGER commands are not working for me. From the research I've done, this appears to be a custom implementation.

There are two places I'm aware of that contain documentation for the SOAR SDK. 

• https://cloud.google.com/chronicle/docs/soar/reference/siemplify-action-module
• https://github.com/chronicle/soar-sdk

I don't see any mention of Logger in the web docs. The code on GitHub is pretty old and seems to reveal that no method for setting the log level is exposed. It also looks like all of the standard logging levels are not available.

I'm hoping that I've just missed something simple. If you could share a line of code that demonstrates how to set the logging level, that would be great. Thank you.

[dnehoda]

This is straight from Response/IDE/Google Connector /google chronicle manager.  

if credentials is None and "type" in kwargs:

credentials = self.from_servcie_account_legacy(**kwargs)

chronicle_soar.LOGGER.warn(

"You are using a legacy version of the integration job! "

"Please update your job instance to the latest version!"

)

There is also in that SDK this:

https://github.com/chronicle/soar-sdk/blob/main/SiemplifyLogger.py 

That ties back into SIEMplify action. 

https://github.com/chronicle/soar-sdk/blob/main/SiemplifyAction.py

[GonFreecss]

I explained in the previous post that I've looked at both of the URLs you posted, and the Siemplify LOGGER is not just basic Python LOGGER commands. The best proof I can provide is that SiemplifyLogger.py (from your link) doesn't support all of the standard logging levels.

I do not see where the log level is being set in the code you pasted. Perhaps you are confusing setting the severity of the log message with setting the logging level. Your code has a log message and the severity is WARN. Setting the logging level determines if that statement will get processed.

Setting the log level is what controls the severity of messages that will be processed and displayed by the logger. What we choose becomes the minimum severity level that will be processed. These are the standard log levels:

• NOTSET
• DEBUG
• INFO
• WARN
• ERROR
• CRITICAL

If the logging level is set to WARN, then only WARN, ERROR, and CRITICAL log statements are processed. If the logging level is set to ERROR, then only ERROR and CRITICAL log statements are processed.

Ultimately, I can filter what I need from the API when I pull the logs. I thought it might be beneficial to skip the processing of levels that are not needed. Hopefully this clarifies what I was looking for. Thanks.

[halcin]

As far as I can see, the SDK has three log levels: info, warn, and error.

siemplify.LOGGER.info(output_message)

siemplify.LOGGER.warn(output_message)

siemplify.LOGGER.error(output_message)

class SiempplifyConnectorsLogger(object):
_log_items = []

def error(self, message):
msg = "ERROR | " + str(message)
print(msg)
self._log_items.append(msg)

def warn(self, message):
msg = "WARN | " + str(message)
print(msg)
self._log_items.append(msg)

def info(self, message):
msg = "INFO | " + str(message)
print(msg)
self._log_items.append(msg)

[SoarAndy]

I would add in a very simple custom function, that way you could leave message everywhere and change 1 field to change Action behaviour throughout

def log_message(message, severity, threshold):
  # message string, severity integer, threshole integer
  if severity>threshold:
    if severity == 1:
      siemplify.logger.info(message)
    if severity == 2:
      ...etc...

#test
threshold = 2
log_message("hello world", 3, threshold)

(code not tested, but it makes the point I hope)