How can we track updates happening to parser in google chronicle ?

[rahul7514]

Hi ,

How can we track updates happening to parser in google chronicle ?
Recently we had a scenario where one of our use cases did not trigger due to the field value change .
we had an alert of a user adding to a group ,however the UDM field for the group was later seen to have changed .Hence it did not trigger . 

So would like to know how can we know updates as an email notification ?

[t-martin]

You can view changes to parsers using this page: https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers

If you click into the release notes for a specific parser, you can then add that page to a collection using the in-page bookmark icon. After that, in your Google Developer Program (top-right) Saved Pages you can manage these collections. In your Profile Settings, ensure you have enabled notifications for documentation Release Notes. This should result in an email notification when any parsers you add to your collection have updated release notes.

[AymanC]

Hi @rahul7514,

When updating a parser, you can select 'diff only fields', which will show you the fields that are different between the previous and new parser. Unfortunately, there is no easy way (that I am aware of) on autonomously identifying whether an update to a parser will affect xxx rules.

However, you could utilise the retrohunt endpoints, and for example build a flow in a CI/CD pipeline to do the following

Parser Request Modification -> Identify rules that utilise that parser -> Run a retrohunt on xxx rules -> Apply parser modification -> Run a retrohunt on xxx rules again -> Compare the difference.

Kind Regards,

Ayman

[rahul7514]

When google updates parser for a log type. Does it get pushed automatically to my console or do i need to manually push the update?? 

[amithpatil]

Hi!

Once a parser update becomes available, you will have the ability to manually update the parser in the Parsers page under Siem settings > Parsers. They will be auto updated on the 4th week of every month : 

https://cloud.google.com/chronicle/docs/event-processing/manage-parser-updates#manage_parser_updates