amorfo77/parsedmarc
1
0
Fork 0
mirror of https://github.com/domainaware/parsedmarc.git synced 2026-08-03 14:12:20 +00:00
Code Issues Projects Releases Wiki Activity

Frame aggregate detection accurately: <feedback> is the detector

Browse Source 
The README presented xml_schema as the aggregate detector. What
actually identifies an aggregate report is its <feedback> XML root
element, which parse_aggregate_report_xml anchors on; the raw XML never
reaches SecOps, so the CBN parser tests xml_schema — the field
parsedmarc synthesizes on every row that came from a <feedback>
document — as its serialized marker. Say so in the detection table and
the explanation paragraph.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Sean Whalen
2026-07-11 15:57:29 -04:00
co-authored by Claude Fable 5
parent 571bbf741b
commit cd2785d440
1 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
google_secops_parser/README.md
+10 -5
View File
@@ -49,7 +49,7 @@ detects them by a field unique to each and maps them as follows:
| parsedmarc report | Detected by | UDM `metadata.event_type` |
| --- | --- | --- |
| DMARC aggregate | `xml_schema` | `EMAIL_TRANSACTION` |
| DMARC aggregate | `xml_schema` (the serialized marker of the `<feedback>` XML root) | `EMAIL_TRANSACTION` |
| DMARC failure | `feedback_type` or `arrival_date_utc` | `EMAIL_TRANSACTION` |
| SMTP TLS (RFC 8460) | `policy_type` or `result_type` | `GENERIC_EVENT` |
@@ -57,10 +57,15 @@ The `or` fallbacks matter: text-format failure reports have no `Feedback-Type`
field (parsedmarc emits no `feedback_type` key for them, but always computes
`arrival_date_utc`), and SMTP TLS failure-detail rows from parsedmarc versions
older than this parser lack `policy_type` (every RFC 8460 failure detail has a
`result_type`). `xml_schema` needs no fallback: the `<feedback>` XML root
element is what identifies an aggregate report, and parsedmarc guarantees a
non-empty `xml_schema` on every aggregate row ("draft" whenever `<version>`
is missing, empty, or whitespace).
`result_type`).
`xml_schema` needs no fallback because it is not something the report
supplies. What actually identifies an aggregate report is its `<feedback>`
XML root element — but the raw XML never reaches SecOps: parsedmarc parses
it and only the flattened JSON rows go over syslog. `xml_schema` is the
field parsedmarc synthesizes on every row that came from a `<feedback>`
document ("draft" whenever `<version>` is missing, empty, or whitespace), so
testing it is one-to-one equivalent to testing for the `<feedback>` root.
`EMAIL_TRANSACTION` and `GENERIC_EVENT` are both valid `metadata.event_type`
values. Note that **`GENERIC_EVENT` events only appear in raw-log and UDM