Parsing Error Message

My guess is you're using a metadata.event_type that requires the use of principal fields, which are currently not set. This is documented here. If you provide more details on the parser and data I can offer some ideas.

-mike

Here's the code snippet. I see the "SETTINGS_MODIFICATION" in statedump output, but UDM fails overall due to error from original post.

Like Mike shared, metadata.event_types may have required fields. For the SETTING_MODIFICATION event type, those fields are here - https://cloud.google.com/chronicle/docs/unified-data-model/udm-usage#udm_example_setting_. It looks like the error you are getting is due to the requirement for "principal: Must be present, non-empty, and include a machine identifier." From that link, in addition to adding a principal, you are going to need to add a target as well.