From cd2785d4408bf08f24d9ba744236784277177914 Mon Sep 17 00:00:00 2001 From: Sean Whalen <44679+seanthegeek@users.noreply.github.com> Date: Sat, 11 Jul 2026 15:57:29 -0400 Subject: [PATCH] Frame aggregate detection accurately: is the detector MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README presented xml_schema as the aggregate detector. What actually identifies an aggregate report is its XML root element, which parse_aggregate_report_xml anchors on; the raw XML never reaches SecOps, so the CBN parser tests xml_schema — the field parsedmarc synthesizes on every row that came from a document — as its serialized marker. Say so in the detection table and the explanation paragraph. Co-Authored-By: Claude Fable 5 --- google_secops_parser/README.md | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/google_secops_parser/README.md b/google_secops_parser/README.md index 6242cd27..92af8338 100644 --- a/google_secops_parser/README.md +++ b/google_secops_parser/README.md @@ -49,7 +49,7 @@ detects them by a field unique to each and maps them as follows: | parsedmarc report | Detected by | UDM `metadata.event_type` | | --- | --- | --- | -| DMARC aggregate | `xml_schema` | `EMAIL_TRANSACTION` | +| DMARC aggregate | `xml_schema` (the serialized marker of the `` XML root) | `EMAIL_TRANSACTION` | | DMARC failure | `feedback_type` or `arrival_date_utc` | `EMAIL_TRANSACTION` | | SMTP TLS (RFC 8460) | `policy_type` or `result_type` | `GENERIC_EVENT` | @@ -57,10 +57,15 @@ The `or` fallbacks matter: text-format failure reports have no `Feedback-Type` field (parsedmarc emits no `feedback_type` key for them, but always computes `arrival_date_utc`), and SMTP TLS failure-detail rows from parsedmarc versions older than this parser lack `policy_type` (every RFC 8460 failure detail has a -`result_type`). `xml_schema` needs no fallback: the `` XML root -element is what identifies an aggregate report, and parsedmarc guarantees a -non-empty `xml_schema` on every aggregate row ("draft" whenever `` -is missing, empty, or whitespace). +`result_type`). + +`xml_schema` needs no fallback because it is not something the report +supplies. What actually identifies an aggregate report is its `` +XML root element — but the raw XML never reaches SecOps: parsedmarc parses +it and only the flattened JSON rows go over syslog. `xml_schema` is the +field parsedmarc synthesizes on every row that came from a `` +document ("draft" whenever `` is missing, empty, or whitespace), so +testing it is one-to-one equivalent to testing for the `` root. `EMAIL_TRANSACTION` and `GENERIC_EVENT` are both valid `metadata.event_type` values. Note that **`GENERIC_EVENT` events only appear in raw-log and UDM