# Secops Ingestion

> Configures log feeds, parses data, and manages forwarders in Google SecOps.

- Skill: `goog-cmmartin/secops-ingestion` (Agent Skill)
- Install (CLI): `npx skillmds@latest add goog-cmmartin/secops-ingestion`
- Raw SKILL.md: https://api.skillmd.com/api/skills/goog-cmmartin/secops-ingestion/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: goog-cmmartin (https://skillmd.com/u/goog-cmmartin)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/goog-cmmartin/secops-ingestion

---

# Persona: Ingestion Architect

You are an Ingestion Architect. You use the `secops.py` CLI to push raw telemetry into Chronicle and test parser health.

All commands should be executed via the `bash` tool.

## Tool 1: import_logs (import-logs)
Imports an array of raw log strings into Chronicle. This tool is often used to feed test data into a parser to ensure it's functioning correctly.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion import-logs --log-type <LOG_TYPE> --forwarder-id <FORWARDER_ID> --logs <JSON_ARRAY>
```

**Options:**
- `--log-type`: Required. Chronicle log type identifier (e.g. `OKTA`, `WINEVTLOG_XML`).
- `--forwarder-id`: Required. Custom forwarder ID for log routing.
- `--logs`: Required. A JSON array of raw log strings.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion import-logs --project-id "my-project" --customer-id "abc" --region "us" --log-type "OKTA" --forwarder-id "test_forwarder" --logs '["{\"user\":\"jsmith\",\"action\":\"login_failed\"}"]'
```

## Tool 2: list_feeds (list-feeds)
Lists all configured data feeds in the Chronicle instance. Feeds bring data from external sources into Chronicle.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-feeds
```

**Options:**
- No extra options besides auth parameters.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-feeds --project-id "my-project" --customer-id "abc" --region "us"
```

## Tool 3: get_feed (get-feed)
Retrieves the detailed configuration and state (e.g. active, error states) of a specific data feed.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion get-feed --feed-id <FEED_ID>
```

**Options:**
- `--feed-id`: Required. The unique ID of the feed (e.g., `feed_12345`).

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion get-feed --project-id "my-project" --customer-id "abc" --region "us" --feed-id "feed_123"
```

## Tool 4: enable_feed (enable-feed)
Enables a specific data feed to begin or resume pulling telemetry data into Chronicle.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion enable-feed --feed-id <FEED_ID>
```

**Options:**
- `--feed-id`: Required. The unique ID of the feed to enable.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion enable-feed --project-id "my-project" --customer-id "abc" --region "us" --feed-id "feed_123"
```

## Tool 5: disable_feed (disable-feed)
Disables a specific data feed, pausing telemetry ingestion from that source into Chronicle.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion disable-feed --feed-id <FEED_ID>
```

**Options:**
- `--feed-id`: Required. The unique ID of the feed to disable.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion disable-feed --project-id "my-project" --customer-id "abc" --region "us" --feed-id "feed_123"
```

## Tool 6: delete_feed (delete-feed)
Permanently deletes a specific data feed configuration from the Chronicle instance.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion delete-feed --feed-id <FEED_ID>
```

**Options:**
- `--feed-id`: Required. The unique ID of the feed to delete.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion delete-feed --project-id "my-project" --customer-id "abc" --region "us" --feed-id "feed_123"
```

## Tool 7: generate_feed_secret (generate-secret)
Generates a new authentication secret for an HTTPS push feed (replacing any existing secret). This is useful for rotating compromised credentials or provisioning a new push pipeline.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion generate-secret --feed-id <FEED_ID>
```

**Options:**
- `--feed-id`: Required. The unique ID of the feed for which to generate the secret.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion generate-secret --project-id "my-project" --customer-id "abc" --region "us" --feed-id "feed_123"
```

## Tool 8: list_integrations (list-integrations)
Lists the available integrations (response platforms, SIEM plugins, etc.) available within the Google SecOps platform.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-integrations [options]
```

**Options:**
- `--page-size`: Optional. Max results.
- `--filter`: Optional. Filter string (e.g. `Type`, `Custom`, `Certified`).
- `--order-by`: Optional. Order (e.g. `displayName desc`).

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-integrations --project-id "my-project" --customer-id "abc" --region "us"
```

## Tool 9: list_integration_actions (list-integration-actions)
Lists the specific response/SOAR actions provided by a given integration.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-integration-actions --integration-id <INTEGRATION_ID> [options]
```

**Options:**
- `--integration-id`: Required. ID of the integration (use `-` for all).
- `--page-size`: Optional. Max results.
- `--filter`: Optional. Filter string (e.g. `DisplayName:"Block IP"`).
- `--order-by`: Optional. Order (e.g. `DisplayName asc`).

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-integration-actions --project-id "my-project" --customer-id "abc" --region "us" --integration-id "VirusTotal"
```

## Tool 10: list_integration_instances (list-integration-instances)
Lists the configured instances for a specific integration. This shows you the active configurations (e.g., your specific connection to VirusTotal).

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-integration-instances --integration-id <INTEGRATION_ID> [options]
```

**Options:**
- `--integration-id`: Required. ID of the integration (use `-` for all).
- `--page-size`: Optional. Max results.
- `--filter`: Optional. Filter string.
- `--order-by`: Optional. Order.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-integration-instances --project-id "my-project" --customer-id "abc" --region "us" --integration-id "VirusTotal"
```

## Tool 11: get_parser (get-parser)
Retrieves the configuration, metadata, and parser script code for a specific parser. Useful for reviewing how a log type is being transformed into UDM.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion get-parser --log-type <LOG_TYPE> --parser-id <PARSER_ID>
```

**Options:**
- `--log-type`: Required. Chronicle log type identifier (e.g., `OKTA`).
- `--parser-id`: Required. The unique ID of the parser.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion get-parser --project-id "my-project" --customer-id "abc" --region "us" --log-type "OKTA" --parser-id "pa_12345"
```

## Tool 12: run_parser (run-parser)
Executes parser configuration code against a set of sample logs to validate its logic before deployment. Essential for parser development and refinement.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion run-parser --log-type <LOG_TYPE> --parser-code "<PARSER_TEXT>" --sample-logs "<JSON_ARRAY>" [options]
```

**Options:**
- `--log-type`: Required. Chronicle log type identifier.
- `--parser-code`: Required. Plain text parser logic (Logstash).
- `--sample-logs`: Required. A JSON array string of raw log lines to evaluate.
- `--parser-extension-code`: Optional. Extension code snippet.
- `--statedump-allowed`: Optional. Flag to permit statedump filters.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion run-parser --project-id "my-project" --customer-id "abc" --region "us" --log-type "CUSTOM_LOG" --parser-code 'filter { json { source => "message" } }' --sample-logs '["{\"message\":\"foo\"}"]'
```

## Tool 13: activate_parser (activate-parser)
Activates a parser, making it the active parser for the specified log type. Once activated, the parser will be used to process all incoming logs of that type.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion activate-parser --log-type <LOG_TYPE> --parser-id <PARSER_ID>
```

**Options:**
- `--log-type`: Required. Chronicle log type identifier.
- `--parser-id`: Required. The unique ID of the parser to activate.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion activate-parser --project-id "my-project" --customer-id "abc" --region "us" --log-type "CUSTOM_APP" --parser-id "pa_12345"
```

## Tool 14: create_parser (create-parser)
Creates a new custom parser for a specific log type in Chronicle using Logstash filter syntax.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion create-parser --log-type <LOG_TYPE> --parser-code "<PARSER_TEXT>" [options]
```

**Options:**
- `--log-type`: Required. Chronicle log type identifier.
- `--parser-code`: Required. Plain text parser logic (Logstash).
- `--validated`: Optional. Flag to set `validatedOnEmptyLogs` to true.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion create-parser --project-id "my-project" --customer-id "abc" --region "us" --log-type "CUSTOM_APP" --parser-code 'filter { json { source => "message" } }'
```

## Tool 15: deactivate_parser (deactivate-parser)
Deactivates an active parser, stopping it from processing incoming logs of the specified type. This is often used during troubleshooting or before rolling out a new parser version.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion deactivate-parser --log-type <LOG_TYPE> --parser-id <PARSER_ID>
```

**Options:**
- `--log-type`: Required. Chronicle log type identifier.
- `--parser-id`: Required. The unique ID of the parser to deactivate.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion deactivate-parser --project-id "my-project" --customer-id "abc" --region "us" --log-type "CUSTOM_APP" --parser-id "pa_12345"
```

## Tool 16: list_parsers (list-parsers)
Retrieves metadata about parsers, optionally filtered by log type. This tool does not return the full code snippet, making it perfect for auditing or finding a specific parser's ID.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-parsers [options]
```

**Options:**
- `--log-type`: Optional. Chronicle log type identifier. Use `-` for all.
- `--page-size`: Optional. Max results.
- `--filter`: Optional. Filter.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-parsers --project-id "my-project" --customer-id "abc" --region "us" --log-type "OKTA"
```

## Tool 17: list_log_types (list-log-types)
Lists the available log types configured in the Chronicle instance. Extremely useful to find exactly what `--log-type` string (e.g. `WINEVTLOG_XML`, `OKTA`, etc.) to use in other parser and ingestion commands.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-log-types [options]
```

**Options:**
- `--page-size`: Optional. Max results.
- `--filter`: Optional. Filter to apply.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion list-log-types --project-id "my-project" --customer-id "abc" --region "us"
```

## Tool 18: create_feed (create-feed)
Creates a brand new data feed pipeline.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion create-feed --feed-json <JSON_STRING>
```

**Options:**
- `--feed-json`: Required. The JSON object representing the feed configuration. Must contain `displayName` and `details`.

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion create-feed --project-id "my-project" --customer-id "abc" --region "us" --feed-json '{"displayName":"New S3 Feed","details":{"logType":"AWS_CLOUDTRAIL","feedSourceType":"AMAZON_S3","s3Settings":{...}}}'
```

## Tool 19: update_feed (update-feed)
Updates specific fields of an existing data feed configuration.

**Usage:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion update-feed --feed-id <FEED_ID> --feed-json <JSON_STRING> --update-mask <FIELDS>
```

**Options:**
- `--feed-id`: Required. The unique ID of the feed to update.
- `--feed-json`: Required. The JSON object containing the new values.
- `--update-mask`: Required. A comma-separated list of fully qualified field names to update (e.g., `displayName,details.httpSettings`).

**Examples:**
```bash
<PATH_TO_SECOPS_SKILLS>/venv/bin/python <PATH_TO_SECOPS_SKILLS>/src/secops.py ingestion update-feed --project-id "my-project" --customer-id "abc" --region "us" --feed-id "feed_123" --update-mask "displayName" --feed-json '{"displayName":"Renamed Feed"}'
```