amorfo77/parsedmarc
1
0
Fork 0
mirror of https://github.com/domainaware/parsedmarc.git synced 2026-07-31 12:45:58 +00:00
Code Issues Projects Releases Wiki Activity

Fix stale boolean-storage comments missed in the bool_value change

Browse Source 
The step-1b comment still said booleans are "stored as string_value
(matching Google's content-hub parsers, which never use bool_value)" —
stale since the switch to typed bool_value storage. 1b now says what it
actually does: convert booleans to strings for the `if` guards only,
because CBN conditionals compare against the preserved JSON type;
storage is typed bool_value per the alignment blocks. Also tightened
the README's Corelight citation, which overstated the string idiom as
something the whole parser relies on rather than just the conditionals.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Sean Whalen
2026-07-11 15:38:21 -04:00
co-authored by Claude Fable 5
parent c8e8cb54c0
commit 4590c0b10c
2 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
google_secops_parser/README.md
+1 -1
View File
@@ -274,7 +274,7 @@ Suggested order:
Community resources (not official Google documentation) that informed this parser's JSON handling and are useful when validating it:
- [Parsing 101: Best Practices & Tips](https://medium.com/@thatsiemguy/parsing-101-best-practices-tips-c2e8b7ce9db8) (Chris Martin / @thatsiemguy) — basis for initializing every `if`-tested field before the `json` filter to avoid `_failed_parsing_`.
- [Corelight parser for SecOps](https://github.com/corelight/CorelightForSecOps) — a large production CBN parser that demonstrates the "convert JSON booleans/numbers to strings" idiom this parser relies on (the `json` filter preserves the original JSON type).
- [Corelight parser for SecOps](https://github.com/corelight/CorelightForSecOps) — a large production CBN parser that demonstrates converting type-preserved JSON booleans to strings before testing them in conditionals, which this parser does in step 1b (storage is a separate matter: this parser stores booleans as typed `bool_value` per Google's parser extension examples).
- [chronicle/cbn-tool](https://github.com/chronicle/cbn-tool) — CLI for the CBN parser APIs (submit and validate a parser).
## License
google_secops_parser/parsedmarc.conf
+10 -8
View File
@@ -203,14 +203,16 @@ filter {
}
# ---------------------------------------------------------------------------
# 1b. Convert parsedmarc's JSON booleans to strings so they can be compared.
# The json{} filter PRESERVES the original JSON type, so without this
# [dmarc_aligned] is a boolean and `== "false"` never matches. Booleans are
# stored as string_value (matching Google's content-hub parsers, which
# never use bool_value). Numeric fields are deliberately NOT converted
# here -- they are stored as number_value (not string) in additional.fields
# so SecOps can range-query and sort them; see the count / *_session_count
# / source_asn blocks below.
# 1b. Convert parsedmarc's JSON booleans to strings so they can be compared
# in conditionals. The json{} filter PRESERVES the original JSON type,
# and CBN conditionals compare against that type, so without this
# [dmarc_aligned] is a boolean and `== "false"` never matches. This is
# ONLY for the `if` guards: in additional.fields these values are
# converted back and stored as typed bool_value (see the alignment
# blocks below), matching the [gsecops] API output. Numeric fields are
# deliberately NOT converted here -- they are stored as number_value in
# additional.fields so SecOps can range-query and sort them; see the
# count / *_session_count / source_asn blocks below.
# ---------------------------------------------------------------------------
mutate {
convert => {