Cite the official Chronicle content-hub parser repo

Add github.com/chronicle/content-hub (Google's official third-party SecOps
parser repo) to the README references and re-anchor the in-code citations to
it. Its current CBN parsers (e.g. CLOUDFLARE_PAGESHIELD, Copyright 2025 Google
SecOps) confirm both fixes this parser makes: initialize every field before the
json{} filter, and convert JSON booleans/numbers to strings before comparison.
Replaces the dated "How to parse JSON data" citation with the authoritative,
actively-maintained source.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

google_secops_parser/README.md

@@ -198,6 +198,7 @@ leading framing before the first `{`.
 - [Parser syntax reference](https://cloud.google.com/chronicle/docs/reference/parser-syntax)
 - [Tips and troubleshooting when writing parsers](https://cloud.google.com/chronicle/docs/event-processing/parser-tips-troubleshooting) — intermediate fields are discarded unless mapped to `@output`; one parser is active per log type.
 - [Manage prebuilt and custom parsers](https://cloud.google.com/chronicle/docs/event-processing/manage-parser-updates)
+- [Chronicle content-hub](https://github.com/chronicle/content-hub) — Google's official repository of third-party SecOps parsers. Its CBN parsers (e.g. [`CLOUDFLARE_PAGESHIELD`](https://github.com/chronicle/content-hub/tree/main/content/parsers/third_party/community/CLOUDFLARE_PAGESHIELD)) use the same conventions this one does: initialize fields before `json`, `convert` JSON types to strings, map to `event.idm.read_only_udm.*`, and finalize with `@output`.
 - [UDM search](https://cloud.google.com/chronicle/docs/investigation/udm-search) — `GENERIC_EVENT` events only surface in raw-log / UDM search, not curated views.
 - [Install the Bindplane agent (collector)](https://cloud.google.com/chronicle/docs/install/install-forwarder)
 - [Feed management](https://cloud.google.com/chronicle/docs/administration/feed-management-overview)

google_secops_parser/parsedmarc.conf

@@ -50,11 +50,11 @@ filter {
   #      run through the SecOps parser-validation tool against a live tenant.
   #      Validate with the sample events in README.md before production use.
   #   2. JSON TYPES ARE PRESERVED. The CBN json{} filter keeps the original JSON
-  #      type (Google's "How to parse JSON data" shows true staying boolean and
-  #      199 staying integer), so parsedmarc's boolean *_aligned / testing /
-  #      normalized_timespan and numeric count / *_count would NOT match string
-  #      comparisons. This parser converts them to strings (step 1b) before any
-  #      `== "true"` / `== "false"` test or %{...} use.
+  #      type (a JSON boolean stays a boolean, a number stays a number), so
+  #      parsedmarc's boolean *_aligned / testing / normalized_timespan and
+  #      numeric count / *_count would NOT match string comparisons. This parser
+  #      converts them to strings (step 1b) before any `== "true"` / `== "false"`
+  #      test or %{...} use -- as Google's official content-hub parsers do.
   #   3. AGGREGATE COUNT. A DMARC aggregate record summarizes "count" messages
   #      from one source IP, not a single message. Each becomes one
   #      EMAIL_TRANSACTION with "count" carried in additional.fields; there is no
@@ -71,7 +71,8 @@ filter {
   #     tests a field that does not exist in the log, and most of these fields
   #     are absent in 2 of the 3 report shapes (or null within one). The json
   #     filter below overwrites whichever are actually present.
-  #     Ref: thatsiemguy "Parsing 101"; matches Google's default parsers.
+  #     Ref: Google's official content-hub CBN parsers (e.g. CLOUDFLARE_PAGESHIELD)
+  #     initialize fields before json the same way; see also thatsiemguy "Parsing 101".
   # ---------------------------------------------------------------------------
   mutate {
     replace => {
@@ -187,6 +188,7 @@ filter {
   #     PRESERVES the original JSON type, so without this, [dmarc_aligned] is a
   #     boolean and `== "false"` never matches (and %{count} on an int is
   #     unreliable). Fields left as "" by step 1a convert as a harmless no-op.
+  #     Google's official content-hub parsers use mutate{convert} the same way.
   # ---------------------------------------------------------------------------
   mutate {
     convert => {