Parsing Error Message

[AJMSecOps]

Has anyone encountered this error before when testing a parser: "udm validation failed: principal field is not set: invalid argument"?

[mikewilusz]

My guess is you're using a metadata.event_type that requires the use of principal fields, which are currently not set. This is documented here. If you provide more details on the parser and data I can offer some ideas.

-mike

[AJMSecOps]

Here's the code snippet. I see the "SETTINGS_MODIFICATION" in statedump output, but UDM fails overall due to error from original post.

[cmorris]

Like Mike shared, metadata.event_types may have required fields. For the SETTING_MODIFICATION event type, those fields are here - https://cloud.google.com/chronicle/docs/unified-data-model/udm-usage#udm_example_setting_. It looks like the error you are getting is due to the requirement for "principal: Must be present, non-empty, and include a machine identifier." From that link, in addition to adding a principal, you are going to need to add a target as well.