From d8b81863280a6790503b2c86b1cc7e5f38b571cd Mon Sep 17 00:00:00 2001 From: Sean Whalen <44679+seanthegeek@users.noreply.github.com> Date: Thu, 4 Jun 2026 11:27:38 -0400 Subject: [PATCH] Cite the official Chronicle content-hub parser repo Add github.com/chronicle/content-hub (Google's official third-party SecOps parser repo) to the README references and re-anchor the in-code citations to it. Its current CBN parsers (e.g. CLOUDFLARE_PAGESHIELD, Copyright 2025 Google SecOps) confirm both fixes this parser makes: initialize every field before the json{} filter, and convert JSON booleans/numbers to strings before comparison. Replaces the dated "How to parse JSON data" citation with the authoritative, actively-maintained source. Co-Authored-By: Claude Opus 4.8 (1M context) --- google_secops_parser/README.md | 1 + google_secops_parser/parsedmarc.conf | 14 ++++++++------ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/google_secops_parser/README.md b/google_secops_parser/README.md index acdd5338..afe3a61c 100644 --- a/google_secops_parser/README.md +++ b/google_secops_parser/README.md @@ -198,6 +198,7 @@ leading framing before the first `{`. - [Parser syntax reference](https://cloud.google.com/chronicle/docs/reference/parser-syntax) - [Tips and troubleshooting when writing parsers](https://cloud.google.com/chronicle/docs/event-processing/parser-tips-troubleshooting) — intermediate fields are discarded unless mapped to `@output`; one parser is active per log type. - [Manage prebuilt and custom parsers](https://cloud.google.com/chronicle/docs/event-processing/manage-parser-updates) +- [Chronicle content-hub](https://github.com/chronicle/content-hub) — Google's official repository of third-party SecOps parsers. Its CBN parsers (e.g. [`CLOUDFLARE_PAGESHIELD`](https://github.com/chronicle/content-hub/tree/main/content/parsers/third_party/community/CLOUDFLARE_PAGESHIELD)) use the same conventions this one does: initialize fields before `json`, `convert` JSON types to strings, map to `event.idm.read_only_udm.*`, and finalize with `@output`. - [UDM search](https://cloud.google.com/chronicle/docs/investigation/udm-search) — `GENERIC_EVENT` events only surface in raw-log / UDM search, not curated views. - [Install the Bindplane agent (collector)](https://cloud.google.com/chronicle/docs/install/install-forwarder) - [Feed management](https://cloud.google.com/chronicle/docs/administration/feed-management-overview) diff --git a/google_secops_parser/parsedmarc.conf b/google_secops_parser/parsedmarc.conf index d4dee5aa..49391aea 100644 --- a/google_secops_parser/parsedmarc.conf +++ b/google_secops_parser/parsedmarc.conf @@ -50,11 +50,11 @@ filter { # run through the SecOps parser-validation tool against a live tenant. # Validate with the sample events in README.md before production use. # 2. JSON TYPES ARE PRESERVED. The CBN json{} filter keeps the original JSON - # type (Google's "How to parse JSON data" shows true staying boolean and - # 199 staying integer), so parsedmarc's boolean *_aligned / testing / - # normalized_timespan and numeric count / *_count would NOT match string - # comparisons. This parser converts them to strings (step 1b) before any - # `== "true"` / `== "false"` test or %{...} use. + # type (a JSON boolean stays a boolean, a number stays a number), so + # parsedmarc's boolean *_aligned / testing / normalized_timespan and + # numeric count / *_count would NOT match string comparisons. This parser + # converts them to strings (step 1b) before any `== "true"` / `== "false"` + # test or %{...} use -- as Google's official content-hub parsers do. # 3. AGGREGATE COUNT. A DMARC aggregate record summarizes "count" messages # from one source IP, not a single message. Each becomes one # EMAIL_TRANSACTION with "count" carried in additional.fields; there is no @@ -71,7 +71,8 @@ filter { # tests a field that does not exist in the log, and most of these fields # are absent in 2 of the 3 report shapes (or null within one). The json # filter below overwrites whichever are actually present. - # Ref: thatsiemguy "Parsing 101"; matches Google's default parsers. + # Ref: Google's official content-hub CBN parsers (e.g. CLOUDFLARE_PAGESHIELD) + # initialize fields before json the same way; see also thatsiemguy "Parsing 101". # --------------------------------------------------------------------------- mutate { replace => { @@ -187,6 +188,7 @@ filter { # PRESERVES the original JSON type, so without this, [dmarc_aligned] is a # boolean and `== "false"` never matches (and %{count} on an int is # unreliable). Fields left as "" by step 1a convert as a harmless no-op. + # Google's official content-hub parsers use mutate{convert} the same way. # --------------------------------------------------------------------------- mutate { convert => {