We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

CreateParser parity mapping

Supported in:

Google secops SIEM

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Tools API (CreateCbnParser) to the modern Chronicle API (CreateParser).

Protocol and mapping overview

Feature	Legacy API (`CreateCbnParser`)	Modern Chronicle API (`CreateParser`)
HTTP Method	`POST`	`POST`
Permissions	Partner token or legacy API keys	`chronicle.googleapis.com/parsers.create`

Request payload field-by-field parity

The modern Chronicle API CreateParserRequest scopes creation under a target log type parent and organizes metadata into structured objects.

Legacy Field (`CreateCbnParserRequest`)	Modern Field (`CreateParserRequest` / `Parser`)	Field type	Parity & Migration Notes
`log_type`	`parent` (in HTTP path)	`string`	Google Cloud Scoping / Architectural Shift: Legacy passed `log_type` inside the payload. The modern API routes this using the standard Google Cloud resource parent path parameter: `projects/{project}/locations/{location}/instances/{instance}/logTypes/{log_type}`.
`config`	`parser.cbn`	`bytes`	Direct Map: The raw configuration byte sequence. Maps to the `cbn` attribute inside the config oneof of the Parser resource.
`change_log`	`parser.changelogs`	`Message`	Restructured: Legacy plain string commit message is mapped to the structured Changelogs message object.
`author`	`parser.creator.author`	`string`	Restructured / Mapped: Author string is nested inside the creator block (`Creator.author`).
`skip_validation_on_no_logs`	—	`bool`	Retired / Automated: Modern parser ingestion workflows automate validation stages and handle empty test logs without requiring explicit client bypass overrides.

Response payload field-by-field parity

Both responses return the created parser resource, with the modern API utilizing standardized lifecycle stages and canonical names.

Legacy Field (`CbnParser` message)	Modern Field (`Parser` message)	Field type	Parity & Migration Notes
`config_id`	`name`	`string`	Parity Mapped: Mapped into the standard canonical resource path under name: `projects/{pr}/locations/{loc}/instances/{in}/logTypes/{lt}/parsers/{id}`.
`log_type`	— (implicit in resource path)	`string`	Managed under the parent segment of the canonical name.
`config`	`cbn`	`bytes`	Raw CBN parser bytes.
`state`	`release_stage` / `validation_stage`	`enum`	Restructured: The legacy monolithic `CbnConfigState` enum is split into granular lifecycle attributes: `release_stage` (for example, `RELEASE`, `ROLLBACK`, `ARCHIVED`) and `validation_stage` (for example, `PASSED`, `FAILED`).
`submit_time` / `timestamps`	`create_time`	`Timestamp`	Standardized creation timestamp (`createTime` in JSON).
`sha256`	—	`string`	Retired: Hash verification is managed internally by Chronicle API storage engines.
`validation_errors`	— (in validation_stage)	`Message`	If validation fails, errors are captured under standard operation metadata or error details.
`change_log`	`changelogs`	`Message`	Structured changelog representation.
`author`	`creator.author`	`string`	Mapped inside creator object.

Key differences

Service Consolidation and Renaming:
- Legacy parser creation was housed under ToolsService with names like CreateCbnParser.
- Modern Chronicle API consolidates parser management under ParserService (CreateParser), utilizing standard Google Cloud parent paths.
Google Cloud Project Scoping Integration:
- Scoped natively under parent project instance log type bindings.
Structured Lifecycle and Creator Attributes:
- Author strings and commit messages are expanded into structured Creator and Changelogs objects.
- Monolithic config states are split into distinct release stages and validation stages.