We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

GetParser parity mapping

Supported in:

Google secops SIEM

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Tools API (GetCbnParser) to the modern Chronicle API (GetParser).

Protocol and mapping overview

Feature	Legacy API (`GetCbnParser`)	Modern Chronicle API (`GetParser`)
HTTP Method	`GET`	`GET`
Permissions	Partner token or legacy API keys	`chronicle.googleapis.com/parsers.get`

Request payload field-by-field parity

The modern Chronicle API GetParserRequest identifies target resources using canonical Google Cloud resource name paths rather than standalone config IDs.

Legacy Field (`GetCbnParserRequest`)	Modern Field (`GetParserRequest`)	Field type	Parity & Migration Notes
`config_id`	`name` (in HTTP path)	`string`	Google Cloud Scoping Context / Renaming: The legacy request passed `config_id` globally in the URL path. The modern API routes this using the standard Google Cloud resource tree structure: `projects/{project}/locations/{region}/instances/{instance}/logTypes/{log_type}/parsers/{parser_id}`.

Response payload field-by-field parity

Both responses return the retrieved parser resource, with the modern API utilizing standardized lifecycle stages and canonical names.

Legacy Field (`CbnParser` message)	Modern Field (`Parser` message)	Field type	Parity & Migration Notes
`config_id`	`name`	`string`	Parity Mapped: Mapped into the standard canonical resource path under name: `projects/{pr}/locations/{loc}/instances/{in}/logTypes/{lt}/parsers/{id}`.
`log_type`	— (implicit in resource path)	`string`	Managed under the parent segment of the canonical name.
`config`	`cbn`	`bytes`	Raw CBN parser bytes.
`state`	`release_stage` / `validation_stage`	`enum`	Restructured: The legacy monolithic `CbnConfigState` enum is split into granular lifecycle attributes: `release_stage` (for example, `RELEASE`, `ROLLBACK`, `ARCHIVED`) and `validation_stage` (for example, `PASSED`, `FAILED`).
`submit_time` / `timestamps`	`create_time`	`Timestamp`	Standardized creation timestamp (`createTime` in JSON).
`sha256`	—	`string`	Retired: Hash verification is managed internally by Chronicle API storage engines.
`validation_errors`	— (in validation_stage)	`Message`	If validation fails, errors are captured under standard operation metadata or error details.
`change_log`	`changelogs`	`Message`	Structured changelog representation.
`author`	`creator.author`	`string`	Mapped inside creator object.

Key differences

Service Consolidation and Renaming:
- Legacy parser retrieval was housed under ToolsService with names like GetCbnParser.
- Modern Chronicle API consolidates parser management under ParserService (GetParser), utilizing standard Google Cloud parent paths.
Google Cloud Project Scoping Integration:
- Scoped natively under parent project instance log type bindings.
Structured Lifecycle and Creator Attributes:
- Author strings and commit messages are expanded into structured Creator and Changelogs objects.
- Monolithic config states are split into distinct release stages and validation stages.