amorfo77/parsedmarc
1
0
Fork 0
mirror of https://github.com/domainaware/parsedmarc.git synced 2026-07-29 20:04:56 +00:00
Code Issues Projects Releases Wiki Activity

Revert overanalyzed changes

Browse Source
This commit is contained in:
Sean Whalen
2026-07-11 16:14:20 -04:00
parent 84848418f9
commit 8935e733cf
5 changed files with 5 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files
google_secops_parser/README.md
+1 -9
View File
@@ -49,7 +49,7 @@ detects them by a field unique to each and maps them as follows:
| parsedmarc report | Detected by | UDM `metadata.event_type` |
| --- | --- | --- |
| DMARC aggregate | `xml_schema` (the serialized marker of the `<feedback>` XML root) | `EMAIL_TRANSACTION` |
| DMARC aggregate | `xml_schema` | `EMAIL_TRANSACTION` |
| DMARC failure | `feedback_type` or `arrival_date_utc` | `EMAIL_TRANSACTION` |
| SMTP TLS (RFC 8460) | `policy_type` or `result_type` | `GENERIC_EVENT` |
@@ -59,14 +59,6 @@ field (parsedmarc emits no `feedback_type` key for them, but always computes
older than this parser lack `policy_type` (every RFC 8460 failure detail has a
`result_type`).
`xml_schema` needs no fallback because it is not something the report
supplies. What actually identifies an aggregate report is its `<feedback>`
XML root element — but the raw XML never reaches SecOps: parsedmarc parses
it and only the flattened JSON rows go over syslog. `xml_schema` is the
field parsedmarc synthesizes on every row that came from a `<feedback>`
document ("draft" whenever `<version>` is missing, empty, or whitespace), so
testing it is one-to-one equivalent to testing for the `<feedback>` root.
`EMAIL_TRANSACTION` and `GENERIC_EVENT` are both valid `metadata.event_type`
values. Note that **`GENERIC_EVENT` events only appear in raw-log and UDM
search**, not in the curated SecOps views — that is the documented behaviour for
google_secops_parser/parsedmarc.conf
+3 -6
View File
@@ -241,12 +241,9 @@ filter {
# policy_type alone is not enough for streams from parsedmarc versions
# that omitted policy_domain/policy_type on SMTP TLS failure-detail rows;
# result_type is required in every RFC 8460 failure detail.
# xml_schema is aggregate-only and guaranteed non-empty: the <feedback>
# XML root element is what identifies an aggregate report, and parsedmarc
# falls back to "draft" whenever <version> is missing, empty, or
# whitespace (parsedmarc/__init__.py), so every JSON line serialized
# from an aggregate report carries a usable value. It is preferred
# over: header_from (can be empty when a
# xml_schema is aggregate-only and parsedmarc defaults it to "draft" when
# the report omits <version> (parsedmarc/__init__.py), so it survives a
# missing version. It is preferred over: header_from (can be empty when a
# record carries no identifiers), adkim (a defaulted policy field), domain
# (a generic name), and dmarc_aligned (a boolean that only becomes testable
# after the convert in step 1b -- detection should not depend on that).