From a131fa937b3ef5844336c9b4bd72ae2e7ce15047 Mon Sep 17 00:00:00 2001 From: Sean Whalen <44679+seanthegeek@users.noreply.github.com> Date: Sat, 11 Jul 2026 15:42:48 -0400 Subject: [PATCH] Explain the actual language constraint behind the 1b boolean conversion The comment described the behavior but not the reason: CBN's documented conditional syntax only compares a token against a quoted string literal -- there is no boolean literal and no truthiness test on event fields -- so a type-preserved JSON boolean can never match any conditional without first converting it to a string. The conversion is in place because CBN mutate has no copy function. Cite the syntax reference. Co-Authored-By: Claude Fable 5 --- google_secops_parser/parsedmarc.conf | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/google_secops_parser/parsedmarc.conf b/google_secops_parser/parsedmarc.conf index 0c3b267d..e9f8c70c 100644 --- a/google_secops_parser/parsedmarc.conf +++ b/google_secops_parser/parsedmarc.conf @@ -203,16 +203,21 @@ filter { } # --------------------------------------------------------------------------- - # 1b. Convert parsedmarc's JSON booleans to strings so they can be compared - # in conditionals. The json{} filter PRESERVES the original JSON type, - # and CBN conditionals compare against that type, so without this - # [dmarc_aligned] is a boolean and `== "false"` never matches. This is - # ONLY for the `if` guards: in additional.fields these values are - # converted back and stored as typed bool_value (see the alignment - # blocks below), matching the [gsecops] API output. Numeric fields are - # deliberately NOT converted here -- they are stored as number_value in - # additional.fields so SecOps can range-query and sort them; see the - # count / *_session_count / source_asn blocks below. + # 1b. Convert parsedmarc's JSON booleans to strings, purely so they can be + # tested in conditionals. CBN's documented conditional syntax only + # compares a token against a quoted string literal (there is no + # `== true` boolean literal, and no truthiness test on event fields), + # while json{} PRESERVES the original JSON type -- so without this + # conversion `[dmarc_aligned] == "false"` can never match and the + # AUTH_VIOLATION decision below never fires. The conversion is in place + # because CBN mutate has no `copy` function to make a disposable string + # copy. Storage is unaffected: additional.fields converts these values + # back and stores typed bool_value (see the alignment blocks below), + # matching the [gsecops] API output. Numeric fields are deliberately + # NOT converted here -- nothing branches on them; they are staged and + # stored as number_value (see the count / *_session_count / source_asn + # blocks below). + # https://docs.cloud.google.com/chronicle/docs/reference/parser-syntax # --------------------------------------------------------------------------- mutate { convert => {