Simplify null propagation in package UDOs

abusech/operators/malwarebazaar/ocsf/map.tql

@@ -12,13 +12,13 @@ $event = {...$event, mb: $event, ocsf: {}}
 
 $event.file = {}
 $event.file.hashes = [
-  {algorithm_id: 1, value: $event.mb.md5_hash} if $event.mb.md5_hash? != null else null,
-  {algorithm_id: 2, value: $event.mb.sha1_hash} if $event.mb.sha1_hash? != null else null,
-  {algorithm_id: 3, value: $event.mb.sha256_hash} if $event.mb.sha256_hash? != null else null,
-  {algorithm_id: 5, value: $event.mb.ssdeep} if $event.mb.ssdeep? != null else null,
-  {algorithm_id: 6, value: $event.mb.tlsh} if $event.mb.tlsh? != null else null,
-  {algorithm_id: 14, value: $event.mb.sha3_384_hash} if $event.mb.sha3_384_hash? != null else null,
-  {algorithm_id: 18, value: $event.mb.imphash} if $event.mb.imphash? != null else null,
+  {algorithm_id: 1, value: $event.mb.md5_hash} if $event.mb.md5_hash? != null,
+  {algorithm_id: 2, value: $event.mb.sha1_hash} if $event.mb.sha1_hash? != null,
+  {algorithm_id: 3, value: $event.mb.sha256_hash} if $event.mb.sha256_hash? != null,
+  {algorithm_id: 5, value: $event.mb.ssdeep} if $event.mb.ssdeep? != null,
+  {algorithm_id: 6, value: $event.mb.tlsh} if $event.mb.tlsh? != null,
+  {algorithm_id: 14, value: $event.mb.sha3_384_hash} if $event.mb.sha3_384_hash? != null,
+  {algorithm_id: 18, value: $event.mb.imphash} if $event.mb.imphash? != null,
 ].collect()
 $event.file.ext = move $event.mb.file_type?
 $event.file.mime_type = move $event.mb.file_type_mime?

abusech/operators/threatfox/ocsf/map.tql

@@ -37,11 +37,11 @@ if $event.threatfox.confidence_level? != null {
   $event.osint.risk_score = move $event.threatfox.confidence_level
 }
 if $event.threatfox.first_seen? != null {
-  $event.osint.created_time = parse_time($event.threatfox.first_seen, "%Y-%m-%d %H:%M:%S UTC")
+  $event.osint.created_time = time($event.threatfox.first_seen)
   drop $event.threatfox.first_seen
 }
 if $event.threatfox.last_seen? != null {
-  $event.osint.modified_time = parse_time($event.threatfox.last_seen, "%Y-%m-%d %H:%M:%S UTC")
+  $event.osint.modified_time = time($event.threatfox.last_seen)
   drop $event.threatfox.last_seen
 }
 if $event.threatfox.malware_printable? != null or $event.threatfox.malware? != null {
@@ -54,7 +54,7 @@ if $event.threatfox.malware_printable? != null or $event.threatfox.malware? != n
 $event.osint.category = move $event.threatfox.threat_type?
 $event.osint.desc = move $event.threatfox.threat_type_desc?
 $event.osint.labels = move $event.threatfox.tags?
-$event.osint.references = [move $event.threatfox.reference] if $event.threatfox.reference? != null else null
+$event.osint.references = [move $event.threatfox.reference] if $event.threatfox.reference? != null
 $event.osint.src_url = "https://threatfox.abuse.ch/ioc/" + encode_url($event.threatfox.ioc)
 $event.osint.type_id = $type_ids[$event.threatfox.ioc_type]? else 99
 if $event.osint.type_id == 99 {

abusech/tests/threatfox/normalize.txt

@@ -11,7 +11,7 @@
   malware_malpedia: "https://malpedia.caad.fkie.fraunhofer.de/details/unknown",
   confidence_level: 75,
   is_compromised: false,
-  first_seen: "2026-05-28 16:41:22 UTC",
+  first_seen: 2026-05-28T16:41:22Z,
   last_seen: null,
   reference: null,
   reporter: "Lenny_3BO",
@@ -38,7 +38,7 @@
   malware_malpedia: "https://malpedia.caad.fkie.fraunhofer.de/details/unknown",
   confidence_level: 75,
   is_compromised: false,
-  first_seen: "2026-05-28 16:41:21 UTC",
+  first_seen: 2026-05-28T16:41:21Z,
   last_seen: null,
   reference: null,
   reporter: "Lenny_3BO",

alphamountain/operators/ocsf/map.tql

@@ -172,7 +172,7 @@ if $event.osint.answers.length() == 0 {
   drop $event.osint.answers
 }
 
-if $event.am.sections?.geo?.ipv4? != null and $event.am.sections.geo.ipv4.length() > 0 {
+if $event.am.sections?.geo?.ipv4?.length() > 0 {
   $event._geo = $event.am.sections.geo.ipv4[0]
   $event.osint.location = {
     country: $event._geo.isoCode,
@@ -199,12 +199,8 @@ if $event.am.sections?.whois? != null {
   $event.osint.expiration_time = time(move $event.am.sections.whois.expires?)
 }
 
-if $event.osint.severity_id? == null {
-  $event.osint.severity_id = 1
-}
-if $event.osint.confidence_id? == null {
-  $event.osint.confidence_id = 0
-}
+$event.osint.severity_id = $event.osint.severity_id? else 1
+$event.osint.confidence_id = $event.osint.confidence_id? else 0
 
 $event.ocsf = {}
 $event.ocsf.activity_id = 2

amazon/operators/route53/ocsf/map.tql

@@ -184,7 +184,7 @@ if $event.route53.has("firewall_rule_action") {
   drop $event.route53.firewall_rule_action
   $event.ocsf.firewall_rule = {
     uid: move $event.route53.firewall_rule_group_id?,
-    match_details: [move $event.route53.firewall_domain_list_id] if $event.route53.firewall_domain_list_id? != null else null,
+    match_details: [move $event.route53.firewall_domain_list_id] if $event.route53.firewall_domain_list_id? != null,
   }
 }
 

amazon/operators/vpc_flow/ocsf/map.tql

@@ -98,12 +98,10 @@ if $event.vpc_flow.reject_reason? != null {
 
 // --- Traffic path (v5+) -----------------------
 
-if $event.vpc_flow.traffic_path? != null {
-  $event.ocsf.connection_info.boundary_id = move $event.vpc_flow.traffic_path
-  // AWS traffic path values 1 and 2 are not the same as OCSF boundary IDs.
-  if $event.ocsf.connection_info.boundary_id >= 1 and $event.ocsf.connection_info.boundary_id <= 8 {
-    $event.ocsf.connection_info.boundary_id = $event.ocsf.connection_info.boundary_id + 3
-  }
+$event.ocsf.connection_info.boundary_id = move $event.vpc_flow.traffic_path?
+// AWS traffic path values 1 and 2 are not the same as OCSF boundary IDs.
+if $event.ocsf.connection_info.boundary_id >= 1 and $event.ocsf.connection_info.boundary_id <= 8 {
+  $event.ocsf.connection_info.boundary_id = $event.ocsf.connection_info.boundary_id + 3
 }
 
 // --- Flow direction and endpoint assignment ---

amazon/tests/vpc_flow/ocsf.txt

@@ -16,6 +16,8 @@
     zone: null,
   },
   connection_info: {
+    boundary: null,
+    boundary_id: null,
     protocol_num: 6,
     protocol_ver: "Internet Protocol version 4 (IPv4)",
     protocol_ver_id: 4,
@@ -85,6 +87,8 @@
     zone: null,
   },
   connection_info: {
+    boundary: null,
+    boundary_id: null,
     protocol_num: 6,
     protocol_ver: "Internet Protocol version 4 (IPv4)",
     protocol_ver_id: 4,
@@ -154,6 +158,8 @@
     zone: null,
   },
   connection_info: {
+    boundary: null,
+    boundary_id: null,
     protocol_num: null,
     tcp_flags: null,
   },
@@ -221,6 +227,8 @@
     zone: null,
   },
   connection_info: {
+    boundary: null,
+    boundary_id: null,
     protocol_num: null,
     tcp_flags: null,
   },

checkpoint/operators/ocsf/base.tql

@@ -14,6 +14,4 @@ $event.ocsf.class_uid = 0
 $event.ocsf.activity_id = 0
 $event.ocsf.type_uid = 0
 
-if $event.ocsf.time? == null {
-  $event.ocsf.time = now()
-}
+$event.ocsf.time = $event.ocsf.time? else now()

checkpoint/operators/ocsf/traffic.tql

@@ -15,16 +15,10 @@ $event.ocsf.traffic = {
   packets_in: move $event.checkpoint.packets_in?,
   packets_out: move $event.checkpoint.packets_out?,
 }
-if $event.ocsf.traffic.bytes? == null and
-   $event.ocsf.traffic.bytes_in? != null and
-   $event.ocsf.traffic.bytes_out? != null {
-  $event.ocsf.traffic.bytes = $event.ocsf.traffic.bytes_in + $event.ocsf.traffic.bytes_out
-}
-if $event.ocsf.traffic.packets? == null and
-   $event.ocsf.traffic.packets_in? != null and
-   $event.ocsf.traffic.packets_out? != null {
-  $event.ocsf.traffic.packets = $event.ocsf.traffic.packets_in + $event.ocsf.traffic.packets_out
-}
+$event.ocsf.traffic.bytes = $event.ocsf.traffic.bytes? else
+  $event.ocsf.traffic.bytes_in? + $event.ocsf.traffic.bytes_out?
+$event.ocsf.traffic.packets = $event.ocsf.traffic.packets? else
+  $event.ocsf.traffic.packets_in? + $event.ocsf.traffic.packets_out?
 
 if $event.checkpoint.duration? != null and $event.ocsf.time? != null {
   $event.ocsf.traffic.end_time = $event.ocsf.time

dhcpd/operators/ocsf/events/transaction.tql

@@ -106,13 +106,7 @@ if $event.dhcpd.transaction_id? != null {
   $event.ocsf.transaction_uid = move $event.dhcpd.transaction_id
 }
 if $event.ocsf.activity_id == 99 {
-  $event.ocsf.activity_name = $event.dhcpd.message_type
-  if $event.dhcpd.client_action? != null {
-    $event.ocsf.activity_name = $event.dhcpd.client_action
-  }
-  if $event.dhcpd.client_event? != null {
-    $event.ocsf.activity_name = $event.dhcpd.client_event
-  }
+  $event.ocsf.activity_name = $event.dhcpd.client_event? else $event.dhcpd.client_action? else $event.dhcpd.message_type
 }
 if $event.dhcpd.via_ip? != null or $event.dhcpd.via_interface? != null {
   if $event.dhcpd.via_ip? != null {

dhcpd/operators/parse.tql

@@ -16,10 +16,7 @@ args:
 
 // Only write inside the selected input event. Bare field assignments can
 // overwrite sibling fields in the caller's record.
-$event.raw_data = null
-if $event.message? != null {
-  $event.raw_data = $event.message.string()
-}
+$event.raw_data = $event.message?.string()
 if $event.raw_data == null {
   @name = "dhcpd.parser_error"
   $event = {

dhcpd/operators/parsers/bootp.tql

@@ -49,10 +49,7 @@ if $event.family? == "bootp" {
   $event.template = $event.message_type.to_lower()
   $event.via = $event.via.string()
   $event.via_ip = $event.via.ip()
-  $event.via_interface = $event.via
-  if $event.via_ip != null {
-    $event.via_interface = null
-  }
+  $event.via_interface = $event.via if $event.via_ip == null
   $event.dhcp4o6 = $event.raw_data.starts_with("DHCP4o6 ")
   if $event.client_mac? != null {
     $event.client.uid = $event.client_mac

dhcpd/operators/parsers/dhcpv4.tql

@@ -88,10 +88,7 @@ if $event.family? == "dhcpv4" and $event.via? != null {
   $event.template = $event.message_type.to_lower()
   $event.via = $event.via.string()
   $event.via_ip = $event.via.ip()
-  $event.via_interface = $event.via
-  if $event.via_ip != null {
-    $event.via_interface = null
-  }
+  $event.via_interface = $event.via if $event.via_ip == null
   $event.dhcp4o6 = $event.raw_data.starts_with("DHCP4o6 ")
   if $event.client_mac? != null {
     $event.client.uid = $event.client_mac

dhcpd/operators/parsers/dhcpv6.tql

@@ -54,10 +54,7 @@ if $event.raw_data.match_regex($dhcpv6_classifier_pattern) {
       category: "transaction",
       dhcp4o6: false,
     }
-    $event.prefix = null
-    if $event.prefix_length? != null {
-      $event.prefix = subnet($event.address, $event.prefix_length)
-    }
+    $event.prefix = subnet($event.address, $event.prefix_length?)
     $event.client_ip = $event.address
     $event.identity_address = move $event.address
     if $event.ia_type == "PD" {

foxio/operators/ocsf/map.tql

@@ -61,7 +61,7 @@ $event.labels = [
 $event.osint = {}
 $event.osint.category = move $event.fingerprint.type
 $event.osint.confidence_id = 0
-$event.osint.labels = $event.labels if $event.labels.length() > 0 else null
+$event.osint.labels = $event.labels if $event.labels.length() > 0
 $event.osint.name = move $event.fingerprint.field
 $event.osint.src_url = "https://ja4db.com/"
 $event.osint.type_id = 4

microsoft/operators/asim/ocsf/common.tql

@@ -17,11 +17,7 @@ if $event.ocsf.metadata?.original_event_uid? != null {
   $event.asim.EventOriginalUid = $event.ocsf.metadata.original_event_uid
   $event.asim.EventUid = $event.ocsf.metadata.original_event_uid
 }
-if $event.ocsf.metadata?.event_code? != null {
-  $event.asim.EventOriginalType = $event.ocsf.metadata.event_code
-} else {
-  $event.asim.EventOriginalType = $event.ocsf.type_uid.string()
-}
+$event.asim.EventOriginalType = $event.ocsf.metadata?.event_code? else $event.ocsf.type_uid.string()
 if $event.ocsf.message? != null {
   $event.asim.EventMessage = $event.ocsf.message
 }
@@ -84,15 +80,10 @@ match $event.ocsf.status? {
     }
   }
 }
-if $event.ocsf.status_detail? != null {
-  $event.asim.EventOriginalResultDetails = $event.ocsf.status_detail
-}
-if $event.ocsf.status_code? != null {
-  $event.asim.EventOriginalResultDetails = $event.ocsf.status_code.string()
-}
+$event.asim.EventOriginalResultDetails = $event.ocsf.status_code?.string() else $event.ocsf.status_detail?
 
+$event.asim.Dvc = $event.ocsf.device?.hostname? else $event.ocsf.device?.ip?.string() else $event.asim.EventProduct
 if $event.ocsf.device?.hostname? != null {
-  $event.asim.Dvc = $event.ocsf.device.hostname
   $event.asim.DvcHostname = $event.ocsf.device.hostname
   $event.asim.DvcFQDN = $event.ocsf.device.hostname
 }
@@ -101,17 +92,6 @@ if $event.ocsf.device?.uid? != null {
 }
 if $event.ocsf.device?.ip? != null {
   $event.asim.DvcIpAddr = $event.ocsf.device.ip
-  if $event.asim.Dvc? == null {
-    $event.asim.Dvc = $event.ocsf.device.ip.string()
-  }
-}
-if $event.asim.Dvc? == null {
-  $event.asim.Dvc = $event.asim.EventProduct
 }
 
-if $event.ocsf.disposition? != null {
-  $event.asim.DvcAction = $event.ocsf.disposition
-}
-if $event.ocsf.action? != null {
-  $event.asim.DvcAction = $event.ocsf.action
-}
+$event.asim.DvcAction = $event.ocsf.action? else $event.ocsf.disposition?

microsoft/tests/asim/ocsf.txt

@@ -9,9 +9,11 @@
   EventOriginalType: "400301",
   EventSeverity: "Informational",
   EventResult: "Success",
+  EventOriginalResultDetails: null,
   Dvc: "dns1",
   DvcHostname: "dns1",
   DvcFQDN: "dns1",
+  DvcAction: null,
   EventSchema: "Dns",
   EventSchemaVersion: "0.1.7",
   EventType: "Query",

microsoft/tests/asim/ocsf/account_change.txt

@@ -9,9 +9,11 @@
   EventOriginalType: "4720",
   EventSeverity: "Informational",
   EventResult: "NA",
+  EventOriginalResultDetails: null,
   Dvc: "DC01.corp.local",
   DvcHostname: "DC01.corp.local",
   DvcFQDN: "DC01.corp.local",
+  DvcAction: null,
   EventSchema: "UserManagement",
   EventSchemaVersion: "0.1.2",
   ActorUsername: "CORP\\jdoe",

microsoft/tests/asim/ocsf/authentication.txt

@@ -9,9 +9,11 @@
   EventOriginalType: "4624",
   EventSeverity: "Informational",
   EventResult: "Success",
+  EventOriginalResultDetails: null,
   Dvc: "DC01.corp.local",
   DvcHostname: "DC01.corp.local",
   DvcFQDN: "DC01.corp.local",
+  DvcAction: null,
   EventSchema: "Authentication",
   EventSchemaVersion: "0.1.4",
   EventType: "Logon",
@@ -48,9 +50,11 @@
   EventOriginalType: "4634",
   EventSeverity: "Informational",
   EventResult: "Success",
+  EventOriginalResultDetails: null,
   Dvc: "DC01.corp.local",
   DvcHostname: "DC01.corp.local",
   DvcFQDN: "DC01.corp.local",
+  DvcAction: null,
   EventSchema: "Authentication",
   EventSchemaVersion: "0.1.4",
   EventType: "Logoff",
@@ -85,7 +89,9 @@
   EventOriginalType: "300201",
   EventSeverity: "Informational",
   EventResult: "Success",
+  EventOriginalResultDetails: null,
   Dvc: "Microsoft Entra ID",
+  DvcAction: null,
   EventSchema: "Authentication",
   EventSchemaVersion: "0.1.4",
   EventType: "Logon",

microsoft/tests/asim/ocsf/detection_finding.txt

@@ -9,7 +9,9 @@
   EventOriginalType: "200401",
   EventSeverity: "High",
   EventResult: "NA",
+  EventOriginalResultDetails: null,
   Dvc: "Microsoft Defender",
+  DvcAction: null,
   EventSchema: "AlertEvent",
   EventSchemaVersion: "0.1",
   EventType: "Alert",

microsoft/tests/asim/ocsf/dhcp_activity.txt

@@ -9,9 +9,11 @@
   EventOriginalType: "400405",
   EventSeverity: "Informational",
   EventResult: "Success",
+  EventOriginalResultDetails: null,
   Dvc: "dhcp1",
   DvcHostname: "dhcp1",
   DvcFQDN: "dhcp1",
+  DvcAction: null,
   EventSchema: "DhcpEvent",
   EventSchemaVersion: "0.1.1",
   EventType: "Assign",

microsoft/tests/asim/ocsf/dns_activity.txt

@@ -9,9 +9,11 @@
   EventOriginalType: "400301",
   EventSeverity: "Informational",
   EventResult: "Success",
+  EventOriginalResultDetails: null,
   Dvc: "dns1",
   DvcHostname: "dns1",
   DvcFQDN: "dns1",
+  DvcAction: null,
   EventSchema: "Dns",
   EventSchemaVersion: "0.1.7",
   EventType: "Query",