From 4590c0b10c4bb69945ad6a84c5fee959f78e37ea Mon Sep 17 00:00:00 2001 From: Sean Whalen <44679+seanthegeek@users.noreply.github.com> Date: Sat, 11 Jul 2026 15:38:21 -0400 Subject: [PATCH] Fix stale boolean-storage comments missed in the bool_value change MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The step-1b comment still said booleans are "stored as string_value (matching Google's content-hub parsers, which never use bool_value)" — stale since the switch to typed bool_value storage. 1b now says what it actually does: convert booleans to strings for the `if` guards only, because CBN conditionals compare against the preserved JSON type; storage is typed bool_value per the alignment blocks. Also tightened the README's Corelight citation, which overstated the string idiom as something the whole parser relies on rather than just the conditionals. Co-Authored-By: Claude Fable 5 --- google_secops_parser/README.md | 2 +- google_secops_parser/parsedmarc.conf | 18 ++++++++++-------- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/google_secops_parser/README.md b/google_secops_parser/README.md index ba0525d0..ff4d4ed6 100644 --- a/google_secops_parser/README.md +++ b/google_secops_parser/README.md @@ -274,7 +274,7 @@ Suggested order: Community resources (not official Google documentation) that informed this parser's JSON handling and are useful when validating it: - [Parsing 101: Best Practices & Tips](https://medium.com/@thatsiemguy/parsing-101-best-practices-tips-c2e8b7ce9db8) (Chris Martin / @thatsiemguy) — basis for initializing every `if`-tested field before the `json` filter to avoid `_failed_parsing_`. -- [Corelight parser for SecOps](https://github.com/corelight/CorelightForSecOps) — a large production CBN parser that demonstrates the "convert JSON booleans/numbers to strings" idiom this parser relies on (the `json` filter preserves the original JSON type). +- [Corelight parser for SecOps](https://github.com/corelight/CorelightForSecOps) — a large production CBN parser that demonstrates converting type-preserved JSON booleans to strings before testing them in conditionals, which this parser does in step 1b (storage is a separate matter: this parser stores booleans as typed `bool_value` per Google's parser extension examples). - [chronicle/cbn-tool](https://github.com/chronicle/cbn-tool) — CLI for the CBN parser APIs (submit and validate a parser). ## License diff --git a/google_secops_parser/parsedmarc.conf b/google_secops_parser/parsedmarc.conf index 841ab594..0c3b267d 100644 --- a/google_secops_parser/parsedmarc.conf +++ b/google_secops_parser/parsedmarc.conf @@ -203,14 +203,16 @@ filter { } # --------------------------------------------------------------------------- - # 1b. Convert parsedmarc's JSON booleans to strings so they can be compared. - # The json{} filter PRESERVES the original JSON type, so without this - # [dmarc_aligned] is a boolean and `== "false"` never matches. Booleans are - # stored as string_value (matching Google's content-hub parsers, which - # never use bool_value). Numeric fields are deliberately NOT converted - # here -- they are stored as number_value (not string) in additional.fields - # so SecOps can range-query and sort them; see the count / *_session_count - # / source_asn blocks below. + # 1b. Convert parsedmarc's JSON booleans to strings so they can be compared + # in conditionals. The json{} filter PRESERVES the original JSON type, + # and CBN conditionals compare against that type, so without this + # [dmarc_aligned] is a boolean and `== "false"` never matches. This is + # ONLY for the `if` guards: in additional.fields these values are + # converted back and stored as typed bool_value (see the alignment + # blocks below), matching the [gsecops] API output. Numeric fields are + # deliberately NOT converted here -- they are stored as number_value in + # additional.fields so SecOps can range-query and sort them; see the + # count / *_session_count / source_asn blocks below. # --------------------------------------------------------------------------- mutate { convert => {