Fix: Standardize URL formation for dev/staging regions across Chronicle SDK

[mihirvala08]

Problem

Manual URL construction in several Chronicle modules was incorrectly using client.region directly (e.g., https://dev-chronicle.googleapis.com), causing failures for dev/staging environments which should map to:

• dev → autopush-chronicle.sandbox.googleapis.com
• staging → staging-chronicle.sandbox.googleapis.com

Additionally, dev/staging should use us as the location in URL paths, not the region name.

Solution

Standardized all manual URL formations to use:

• client.base_url(APIVersion.X) for domain + API version
• client.instance_id for the full instance path

This ensures proper domain mapping and location handling across all regions.

Files Changed

Source Files

• src/secops/chronicle/log_ingest.py - ingest_udm method
• src/secops/chronicle/nl_search.py - translate_nl_to_udm function
• src/secops/chronicle/rule.py - test_rule function
• src/secops/chronicle/gemini.py - 3 functions (create_conversation, enable_duet_ai_chat, query_gemini)
• src/secops/chronicle/data_export.py - _get_formatted_log_type function

Test Files

• tests/chronicle/test_gemini.py - Updated mock fixture and assertions
• tests/chronicle/test_nl_search.py - Updated mock fixture and assertions

[mihirvala08]

/run-integration-tests 22d4743