☁️ Google Cloud Chronicle Retrohunt Terraform Module

Provisions a Google SecOps (Chronicle) retrohunt, targeting hashicorp/google ~> 7.0.

• Creates exactly one google_chronicle_retrohunt resource — a one-time execution of a terraform-google-chronicle-rule over a specified past time range.
• rule takes the SHORT rule ID, identical reference pattern to terraform-google-chronicle-rule-deployment's own rule argument — confirmed via the resource's own live doc example.
• This resource is effectively create-only — its own timeouts block confirms only create/delete are supported, no update.
• A documented discrepancy: the resource's own prose docs mention a deletion_policy argument, but the live schema-JSON (ground truth) confirms it does not exist on this resource at this provider version.

💡 Why it matters: Retrohunts let a SOC validate a new or changed detection rule against historical data before trusting it against live traffic — modeling the retrohunt request as code keeps that validation step reviewable and repeatable.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

flowchart LR
 RULE["terraform-google-chronicle-rule<br/>(same batch, required)"]:::keystone
 THIS["terraform-google-chronicle-retrohunt<br/>(this module — standalone)"]:::thismodule

 RULE -.->|"basename(name) -> rule"| THIS

 classDef thismodule fill:#4285F4,color:#FFFFFF,stroke:#174EA6,stroke-width:1px;
 classDef keystone fill:#174EA6,color:#FFFFFF,stroke:#174EA6,stroke-width:1px;

Validated via the Mermaid Chart MCP (valid: true).

flowchart TB
 subgraph Inputs
 RULEV["var.rule"]
 PI["var.process_interval<br/>(start_time / end_time)"]
 RID["var.retrohunt_id"]
 end

 KEYSTONE["google_chronicle_retrohunt.this"]:::keystone

 subgraph Outputs
 ID["id / name"]
 STATE["state / progress_percentage"]
 EI["execution_interval"]
 end

 RULEV --> KEYSTONE
 PI --> KEYSTONE
 RID --> KEYSTONE

 KEYSTONE --> ID
 KEYSTONE --> STATE
 KEYSTONE --> EI

 classDef keystone fill:#174EA6,color:#FFFFFF,stroke:#174EA6,stroke-width:1px;

Validated via the Mermaid Chart MCP (valid: true).

Resource inventory: google_chronicle_retrohunt.this (1 resource).

Schema notes that bite:

• rule wants the SHORT rule ID — confirmed via the resource's own live doc example, identical pattern to terraform-google-chronicle-rule-deployment.
• No update timeout — confirmed this resource is effectively create-only; changing process_interval or rule forces a new resource.
• deletion_policy doc/schema mismatch — confirmed no such argument exists in the live schema-JSON despite prose docs referencing it. This module does not model it.
• No labels, no self_link — family-wide facts.

• roles/chronicle.admin — same family-wide role as every other Chronicle module.

• chronicle.googleapis.com enabled.
• A Chronicle (Google SecOps) instance must already be activated for the target project.
• The referenced rule must already exist.

terraform-google-chronicle-retrohunt/
├── providers.tf
├── variables.tf # instance, location, rule, retrohunt_id, process_interval, timeouts
├── main.tf # google_chronicle_retrohunt.this
├── outputs.tf # id, name, retrohunt_id, state, progress_percentage, execution_interval
├── README.md
├── SCOPE.md
└── examples/
 └── basic/

module "excessive_login_failures" {
  source = "git::https://github.com/microsoftexpert/terraform-google-chronicle-rule.git?ref=v1.0.0"

  instance = "00000000-0000-0000-0000-000000000000"
  location = "us"

  text = <<-EOT
 rule excessive_login_failures {
 meta:
 author = "casey-secops"
 events:
 $e.metadata.event_type = "USER_LOGIN"
 $e.security_result.action = "BLOCK"
 $userid = $e.principal.user.userid
 match:
 $userid over 10m
 condition:
 #e > 10
 }
 EOT
}

module "excessive_login_failures_retrohunt" {
  source = "git::https://github.com/microsoftexpert/terraform-google-chronicle-retrohunt.git?ref=v1.0.0"

  instance = "00000000-0000-0000-0000-000000000000"
  location = "us"
  rule     = basename(module.excessive_login_failures.name)

  process_interval = {
    start_time = "2026-01-01T00:00:00Z"
    end_time   = "2026-02-01T00:00:00Z"
  }
}

Consumes:

Emits:

No self_link row.

module "excessive_login_failures_retrohunt" {
  source = "git::https://github.com/microsoftexpert/terraform-google-chronicle-retrohunt.git?ref=v1.0.0"

  instance = "00000000-0000-0000-0000-000000000000"
  location = "us"
  rule     = "ru_a1b2c3d4"

  process_interval = {
    start_time = "2026-01-01T00:00:00Z"
    end_time   = "2026-02-01T00:00:00Z"
  }
}

module "recent_week_retrohunt" {
  source = "git::https://github.com/microsoftexpert/terraform-google-chronicle-retrohunt.git?ref=v1.0.0"

  instance = "00000000-0000-0000-0000-000000000000"
  location = "us"
  rule     = "ru_b2c3d4e5"

  process_interval = {
    start_time = "2026-07-01T00:00:00Z"
    end_time   = "2026-07-08T00:00:00Z"
  }
}

module "quarter_validation_retrohunt" {
  source = "git::https://github.com/microsoftexpert/terraform-google-chronicle-retrohunt.git?ref=v1.0.0"

  instance = "00000000-0000-0000-0000-000000000000"
  location = "us"
  rule     = "ru_c3d4e5f6"

  process_interval = {
    start_time = "2026-01-01T00:00:00Z"
    end_time   = "2026-04-01T00:00:00Z"
  }
}

module "named_retrohunt" {
  source = "git::https://github.com/microsoftexpert/terraform-google-chronicle-retrohunt.git?ref=v1.0.0"

  instance     = "00000000-0000-0000-0000-000000000000"
  location     = "us"
  rule         = "ru_d4e5f6a7"
  retrohunt_id = "jan-2026-validation"

  process_interval = {
    start_time = "2026-01-01T00:00:00Z"
    end_time   = "2026-02-01T00:00:00Z"
  }
}

module "year_long_retrohunt" {
  source = "git::https://github.com/microsoftexpert/terraform-google-chronicle-retrohunt.git?ref=v1.0.0"

  instance = "00000000-0000-0000-0000-000000000000"
  location = "us"
  rule     = "ru_e5f6a7b8"

  process_interval = {
    start_time = "2025-01-01T00:00:00Z"
    end_time   = "2026-01-01T00:00:00Z"
  }

  timeouts = {
    create = "60m"
  }
}

module "excessive_login_failures" {
  source = "git::https://github.com/microsoftexpert/terraform-google-chronicle-rule.git?ref=v1.0.0"

  instance = "00000000-0000-0000-0000-000000000000"
  location = "us"

  text = <<-EOT
 rule excessive_login_failures {
 meta:
 author = "casey-secops"
 severity = "Medium"
 events:
 $e.metadata.event_type = "USER_LOGIN"
 $e.security_result.action = "BLOCK"
 $userid = $e.principal.user.userid
 match:
 $userid over 10m
 condition:
 #e > 10
 }
 EOT
}

module "excessive_login_failures_retrohunt" {
  source = "git::https://github.com/microsoftexpert/terraform-google-chronicle-retrohunt.git?ref=v1.0.0"

  instance = "00000000-0000-0000-0000-000000000000"
  location = "us"
  rule     = basename(module.excessive_login_failures.name)

  process_interval = {
    start_time = "2026-01-01T00:00:00Z"
    end_time   = "2026-02-01T00:00:00Z"
  }
}

No labels variable. No deletion_policy variable (see Architecture Notes).

No self_link, no labels-related outputs.

• rule is the short rule ID, not the full resource name — confirmed via the resource's own live doc example, identical to terraform-google-chronicle-rule-deployment's own pattern.
• This resource is effectively create-only — no update timeout exists; any change to process_interval or rule forces replacement, not an in-place update.
• deletion_policy doc/schema discrepancy, confirmed and documented: this resource's published prose documentation references a deletion_policy argument, but the live schema-JSON dump (ground truth per house standard) confirms it does not exist at this provider version. This module intentionally omits it — do not add a deletion_policy variable without first re-verifying against a fresh terraform providers schema -json dump.
• No labels, no self_link — family-wide facts.

No deletion_policy-based secure default applies to this resource — see Architecture Notes.

cd terraform-google-chronicle-retrohunt
terraform init -backend=false
terraform validate
terraform fmt -check

validate/fmt confirm process_interval's non-empty timestamp requirement and internal type consistency, but cannot validate that start_time/end_time are well-formed RFC3339 values, that start_time precedes end_time, or that the referenced rule actually exists — those are API-level rejections only apply can surface.

$ terraform output
id = "projects/casey-prod/locations/us/instances/00000000-0000-0000-0000-000000000000/rules/ru_a1b2c3d4/retrohunts/rh_a1b2c3d4"
name = "projects/casey-prod/locations/us/instances/00000000-0000-0000-0000-000000000000/rules/ru_a1b2c3d4/retrohunts/rh_a1b2c3d4"
retrohunt_id = "rh_a1b2c3d4"
state = "RUNNING"
progress_percentage = 42.5
execution_interval = [
 {
 "start_time" = "2026-01-01T00:00:00Z"
 "end_time" = "2026-02-01T00:00:00Z"
 },
]

• google_chronicle_retrohunt provider docs
• terraform-google-chronicle-rule
• terraform-google-chronicle-rule-deployment
• This module's SCOPE.md