amorfo77/parsedmarc
1
0
Fork 0
mirror of https://github.com/domainaware/parsedmarc.git synced 2026-07-31 04:35:58 +00:00
Code Issues Projects Releases Wiki Activity

Explain the actual language constraint behind the 1b boolean conversion

Browse Source 
The comment described the behavior but not the reason: CBN's documented
conditional syntax only compares a token against a quoted string
literal -- there is no boolean literal and no truthiness test on event
fields -- so a type-preserved JSON boolean can never match any
conditional without first converting it to a string. The conversion is
in place because CBN mutate has no copy function. Cite the syntax
reference.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Sean Whalen
2026-07-11 15:42:48 -04:00
co-authored by Claude Fable 5
parent 4590c0b10c
commit a131fa937b
1 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
google_secops_parser/parsedmarc.conf
+15 -10
View File
@@ -203,16 +203,21 @@ filter {
}
# ---------------------------------------------------------------------------
# 1b. Convert parsedmarc's JSON booleans to strings so they can be compared
# in conditionals. The json{} filter PRESERVES the original JSON type,
# and CBN conditionals compare against that type, so without this
# [dmarc_aligned] is a boolean and `== "false"` never matches. This is
# ONLY for the `if` guards: in additional.fields these values are
# converted back and stored as typed bool_value (see the alignment
# blocks below), matching the [gsecops] API output. Numeric fields are
# deliberately NOT converted here -- they are stored as number_value in
# additional.fields so SecOps can range-query and sort them; see the
# count / *_session_count / source_asn blocks below.
# 1b. Convert parsedmarc's JSON booleans to strings, purely so they can be
# tested in conditionals. CBN's documented conditional syntax only
# compares a token against a quoted string literal (there is no
# `== true` boolean literal, and no truthiness test on event fields),
# while json{} PRESERVES the original JSON type -- so without this
# conversion `[dmarc_aligned] == "false"` can never match and the
# AUTH_VIOLATION decision below never fires. The conversion is in place
# because CBN mutate has no `copy` function to make a disposable string
# copy. Storage is unaffected: additional.fields converts these values
# back and stores typed bool_value (see the alignment blocks below),
# matching the [gsecops] API output. Numeric fields are deliberately
# NOT converted here -- nothing branches on them; they are staged and
# stored as number_value (see the count / *_session_count / source_asn
# blocks below).
# https://docs.cloud.google.com/chronicle/docs/reference/parser-syntax
# ---------------------------------------------------------------------------
mutate {
convert => {