diff --git a/group17/README.md b/group17/README.md
new file mode 100644
index 0000000..352000e
--- /dev/null
+++ b/group17/README.md
@@ -0,0 +1,41 @@
+# Parser Wireshark for Chronicles
+
+Questo documento descrive lo sviluppo di un parser progettato per convertire file PCAP, generati da Wireshark, in un formato JSON strutturato compatibile con Google Chronicle. Wireshark è uno strumento open-source per l'analisi del traffico di rete, mentre Chronicle è una piattaforma di sicurezza basata su cloud, ottimizzata per l'elaborazione di dati in formato JSON, che consente l'analisi avanzata delle minacce e la gestione degli eventi.
+	
+Il parser supera il divario tra il formato binario PCAP e il formato JSON leggibile richiesto da Chronicle. Il progetto comprende:
+
+* Lo studio delle complessità del formato PCAP.
+* L'utilizzo di Python e di librerie come Pyshark per un'efficace estrazione dei dati.
+* L'implementazione di funzionalità avanzate come la validazione dei timestamp, la gestione dei batch di eventi e l'integrazione con le API di Google Cloud.
+
+Sono stati sviluppati quattro prototipi iterativi, che affrontano problematiche come l'ottimizzazione della memoria, la gestione degli errori e la validazione dei dati. Gli obiettivi futuri includono l'integrazione completa con le API di Chronicle, l'espansione delle funzionalità per analizzare ulteriori tipi di dati di rete e miglioramenti dell'efficienza per gestire dati su larga scala.
+
+# Utilizzo del parser
+```
+python parser.py <pcap file> <time of first packet - ISO8601 format>
+```
+
+Ad esempio
+
+```
+python parser.py ./test_7k.pcap 2020-12-30T12:34:56
+```
+
+## Struttura repository
+```
+* code : contiene il codice Python del parser e un file di configurazione di esempio
+* docs : presentazione e report del progetto
+```
+
+## Link utili
+Repository originale: [GitHub](https://github.com/securityresearchlab/Cybersecurity-projects-2024)
+File di test: [OneDrive (Unibo account required)](https://liveunibo-my.sharepoint.com/:f:/g/personal/iacopo_sbalchiero_studio_unibo_it/EuY7TXE7wgVKq-uQf34obAoBRHEfOYg3BqH-53kXEfLvbQ?e=oEV7ZF)
+
+## Autori
+
+| Nome                                                  | Profilo GitHub                              |
+| ----------------------------------------------------- | ------------------------------------------- |
+| <div align="center"><img src="https://github.com/PietroColoretti01.png" width="50" style="border-radius: 50%;"><br>Pietro Coloretti</div> | [GitHub](https://github.com/PietroColoretti01) |
+| <div align="center"><img src="https://github.com/leonardo-gennaioli.png" width="50" style="border-radius: 50%;"><br>Leonardo Gennaioli</div> | [GitHub](https://github.com/leonardo-gennaioli) |
+| <div align="center"><img src="https://github.com/IacopoSb.png" width="50" style="border-radius: 50%;"><br>Iacopo Sbalchiero</div> | [GitHub](https://github.com/IacopoSb)       |
+
diff --git a/group17/code/config.conf b/group17/code/config.conf
new file mode 100644
index 0000000..cb79144
--- /dev/null
+++ b/group17/code/config.conf
@@ -0,0 +1,4 @@
+{
+  "CUSTOMER_ID": "01234567-89ab-cdef-0123-456789abcdef",
+  "SERVICE_ACCOUNT_FILE": "path/to/your/service-account-key.json"
+}
diff --git a/group17/code/parser.py b/group17/code/parser.py
new file mode 100644
index 0000000..9e6a7ad
--- /dev/null
+++ b/group17/code/parser.py
@@ -0,0 +1,561 @@
+# Standard library imports
+import pyshark
+import datetime
+import json
+import os
+import uuid
+import requests
+import logging
+import time
+import sys
+import google.auth
+from google.auth.transport.requests import Request
+from google.oauth2.service_account import Credentials
+from datetime import timezone
+from dateutil import parser
+from typing import Dict, Optional
+
+# Global configuration parameters
+MAX_FILE_SIZE = 1024 * 1024  # 1MB in bytes - Maximum size for each output file
+OUTPUT_DIR = "udm_events"     # Directory where output files will be stored
+FILE_PREFIX = "udm_events"    # Prefix for output filenames
+LOG_FILE = "pcap_processor.log"  # Name of the log file
+
+# Configure logging with both file and console output
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(message)s',
+    handlers=[
+        logging.FileHandler(LOG_FILE),
+        logging.StreamHandler()
+    ]
+)
+logger = logging.getLogger(__name__)
+
+def validate_timestamp(timestamp_str):
+    """
+    Validate and parse a timestamp string in ISO 8601 format.
+    
+    Args:
+        timestamp_str (str): Timestamp string in ISO 8601 format (e.g., '2024-01-03T14:30:00Z')
+        
+    Returns:
+        datetime: Parsed datetime object with UTC timezone if valid, None otherwise
+    """
+    try:
+        parsed_time = parser.parse(timestamp_str)
+        # Ensure timezone is set to UTC if not specified
+        if parsed_time.tzinfo is None:
+            parsed_time = parsed_time.replace(tzinfo=timezone.utc)
+        return parsed_time
+    except (ValueError, TypeError) as e:
+        logger.error(f"Timestamp format error: {e}")
+        logger.error("Please use a valid ISO 8601 format (e.g., '2024-01-03T14:30:00Z')")
+        return None
+
+def get_reference_timestamp():
+    """
+    Get a reference timestamp from command line parameter.
+    The timestamp should already be validated when this is called.
+    
+    Returns:
+        float: Unix timestamp (seconds since epoch) for the reference time
+    """
+    return reference_time.timestamp()
+
+def get_absolute_timestamp(packet, reference_time=None):
+    """
+    Convert a packet's relative timestamp to an absolute timestamp based on the reference time.
+    
+    Args:
+        packet: pyshark packet object containing sniff_timestamp
+        reference_time (float, optional): Reference timestamp to base conversions on
+        
+    Returns:
+        str: ISO 8601 formatted timestamp string with UTC timezone
+    """
+    try:
+        packet_timestamp = float(packet.sniff_timestamp)
+        
+        # Initialize reference time on first packet
+        if not hasattr(get_absolute_timestamp, "first_packet_time"):
+            if reference_time is None:
+                reference_time = get_reference_timestamp()
+            get_absolute_timestamp.first_packet_time = packet_timestamp
+            get_absolute_timestamp.reference_time = reference_time
+            get_absolute_timestamp.offset = reference_time - packet_timestamp
+
+        # Calculate absolute timestamp
+        absolute_timestamp = packet_timestamp + get_absolute_timestamp.offset
+        dt = datetime.datetime.fromtimestamp(absolute_timestamp, tz=timezone.utc)
+        return dt.isoformat() + "Z"
+    except Exception as e:
+        logger.error(f"Timestamp conversion error: {e}")
+        return None
+
+def load_config(file_path):
+    """
+    Load configuration from a JSON file.
+    
+    Args:
+        file_path (str): Path to the configuration file
+        
+    Returns:
+        dict: Configuration dictionary if successful, None otherwise
+    """
+    try:
+        with open(file_path, 'r', encoding='utf-8') as f:
+            config = json.load(f)
+        logger.info(f"Successfully loaded configuration from {file_path}")
+        return config
+    except FileNotFoundError:
+        logger.error(f"Error: file {file_path} not found")
+        return None
+    except json.JSONDecodeError:
+        logger.error(f"Error: file {file_path} does not contain valid JSON")
+        return None
+
+def get_access_token():
+    """
+    Obtain an access token for Google Cloud authentication using service account credentials.
+    
+    Returns:
+        str: Access token if successful, None otherwise
+    """
+    try:
+        if not SERVICE_ACCOUNT_FILE or not os.path.isfile(SERVICE_ACCOUNT_FILE):
+            logger.warning("Service account key file not provided. Skipping cloud ingestion.")
+            return None
+        credentials = Credentials.from_service_account_file(
+            SERVICE_ACCOUNT_FILE,
+            scopes=["https://www.googleapis.com/auth/cloud-platform"]
+        )
+        credentials.refresh(Request())
+        logger.info("Successfully obtained access token")
+        return credentials.token
+    except Exception as e:
+        logger.error(f"Error obtaining access token: {e}")
+        return None
+
+def send_events_to_google_cloud(events_data):
+    """
+    Send processed events to Google Cloud Malachite Ingestion endpoint.
+    
+    Args:
+        events_data (dict): Dictionary containing events to be sent
+        
+    Returns:
+        Response: API response if successful, None otherwise
+    """
+    access_token = get_access_token()
+    if not access_token:
+        logger.error("Failed to obtain an access token. Cannot send events.")
+        return None
+
+    headers = {
+        "Content-Type": "application/json",
+        "Authorization": f"Bearer {access_token}"
+    }
+
+    try:
+        response = requests.post(
+            INGESTION_URL, 
+            headers=headers, 
+            json=events_data
+        )
+        
+        if response.status_code == 200:
+            logger.info("Successfully sent events to Google Cloud Malachite Ingestion")
+            return response
+        else:
+            logger.error(f"Error sending events. Status code: {response.status_code}")
+            logger.error(f"Response content: {response.text}")
+            return response
+    
+    except requests.RequestException as e:
+        logger.error(f"Error during API request: {e}")
+        return None
+
+class ProcessingStats:
+    """
+    Track and maintain statistics about the PCAP processing operation.
+    Includes timing, packet counts, and performance metrics.
+    """
+    def __init__(self):
+        self.start_time = time.time()
+        self.packets_processed = 0
+        self.http_connections = 0
+        self.tcp_connections = 0
+        self.events_generated = 0
+
+    def get_elapsed_time(self):
+       """Calculate total elapsed processing time."""
+       return time.time() - self.start_time
+
+    def print_summary(self):
+        """Print a summary of all processing statistics in a single log line."""
+        elapsed_time = self.get_elapsed_time()
+        avg_speed = self.packets_processed / elapsed_time if elapsed_time > 0 else 0
+        logger.info(
+            f"Stats - Time: {elapsed_time:.2f}s, Packets: {self.packets_processed}, "
+            f"HTTP Connections: {self.http_connections}, TCP Connections: {self.tcp_connections}, "
+            f"Events: {self.events_generated}, Speed: {avg_speed:.2f} packets/s"
+        )
+
+class HTTPConnection:
+    """
+    Represents a single HTTP connection and maintains its state throughout the packet capture.
+    Tracks both request and response information for complete HTTP transactions.
+    """
+    def __init__(self, first_packet, reference_time):
+        self.timestamp = get_absolute_timestamp(first_packet, reference_time)
+        self.method = None
+        self.response_code = None
+        self.url = None
+        self.src_ip = None
+        self.src_port = None
+        self.dst_ip = None
+        self.dst_port = None
+        self.host = None
+        self.src_hostname = None
+        self.update_from_packet(first_packet)
+
+    def update_from_packet(self, packet):
+        """
+        Update connection information based on a new packet in the stream.
+        
+        Args:
+            packet: pyshark packet object containing HTTP information
+        """
+        try:
+            # Extract IP information if available
+            if hasattr(packet, 'ip'):
+                self.src_ip = self.src_ip or packet.ip.src
+                self.dst_ip = self.dst_ip or packet.ip.dst
+            
+            # Extract TCP port information
+            if hasattr(packet, 'tcp'):
+                self.src_port = self.src_port or int(packet.tcp.srcport)
+                self.dst_port = self.dst_port or int(packet.tcp.dstport)
+
+            # Extract HTTP-specific information
+            if 'HTTP' in packet:
+                if hasattr(packet.http, 'request_method'):
+                    self.method = packet.http.request_method
+                    if hasattr(packet.http, 'request_uri'):
+                        self.url = packet.http.request_uri
+                    if hasattr(packet.http, 'host'):
+                        self.host = packet.http.host
+
+                if hasattr(packet.http, 'response_code'):
+                    self.response_code = int(packet.http.response_code)
+
+        except AttributeError as e:
+            logger.error(f"Error extracting packet data: {e}")
+
+    def to_event(self) -> dict:
+        """
+        Convert the HTTP connection information to a standardized event format.
+        
+        Returns:
+            dict: Formatted event dictionary ready for ingestion
+        """
+        event = {
+            "metadata": {
+                "event_timestamp": self.timestamp,
+                "event_type": "NETWORK_HTTP",
+                "product_name": "Wireshark",
+                "vendor_name": "Wireshark Inc."
+            },
+            "network": {
+                "http": {
+                    "method": self.method
+                }
+            },
+            "principal": {
+                "ip": [self.src_ip],
+                "port": self.src_port
+            },
+            "target": {
+                "ip": [self.dst_ip],
+                "port": self.dst_port
+            }
+        }
+
+        # Add optional fields if they exist
+        if self.response_code:
+            event["network"]["http"]["response_code"] = self.response_code
+        
+        if self.host:
+            event["target"]["hostname"] = self.host
+        
+        if self.url:
+            event["target"]["url"] = self.url
+
+        if self.src_hostname:
+            event["principal"]["hostname"] = self.src_hostname
+
+        return event
+
+class TCPConnection:
+    """
+    Represents a TCP connection and maintains its state throughout the packet capture.
+    Generates a single event per connection with cumulative statistics.
+    """
+    def __init__(self, first_packet, reference_time):
+        self.timestamp = get_absolute_timestamp(first_packet, reference_time)
+        self.src_ip = None
+        self.src_port = None
+        self.dst_ip = None
+        self.dst_port = None
+        self.bytes_sent = 0
+        self.bytes_received = 0
+        self.src_hostname = None
+        self.establishment_time = self.timestamp
+        self.termination_time = None
+        self.update_from_packet(first_packet)
+
+    def update_from_packet(self, packet):
+        """
+        Update connection information based on a new packet in the stream.
+        """
+        try:
+            current_timestamp = get_absolute_timestamp(packet, None)
+            self.termination_time = current_timestamp
+
+            # Extract IP information if available
+            if hasattr(packet, 'ip'):
+                self.src_ip = self.src_ip or packet.ip.src
+                self.dst_ip = self.dst_ip or packet.ip.dst
+            
+            # Extract TCP information and track data transfer
+            if hasattr(packet, 'tcp'):
+                self.src_port = self.src_port or int(packet.tcp.srcport)
+                self.dst_port = self.dst_port or int(packet.tcp.dstport)
+                
+                # Track data transfer
+                if hasattr(packet.tcp, 'len'):
+                    tcp_len = int(packet.tcp.len)
+                    if packet.ip.src == self.src_ip:
+                        self.bytes_sent += tcp_len
+                    else:
+                        self.bytes_received += tcp_len
+
+        except AttributeError as e:
+            logger.error(f"Error extracting TCP packet data: {e}")
+
+    def to_event(self) -> dict:
+        """
+        Convert the TCP connection information to a standardized event format.
+        """
+        event = {
+            "metadata": {
+                "event_timestamp": self.termination_time or self.timestamp,
+                "event_type": "NETWORK_TCP",
+                "product_name": "Wireshark",
+                "vendor_name": "Wireshark Inc."
+            },
+            "network": {
+                "tcp": {
+                    "bytes_sent": self.bytes_sent,
+                    "bytes_received": self.bytes_received,
+                    "establishment_time": self.establishment_time,
+                    "termination_time": self.termination_time
+                }
+            },
+            "principal": {
+                "ip": [self.src_ip],
+                "port": self.src_port
+            },
+            "target": {
+                "ip": [self.dst_ip],
+                "port": self.dst_port
+            }
+        }
+
+        if self.src_hostname:
+            event["principal"]["hostname"] = self.src_hostname
+
+        return event
+
+        
+class EventBatcher:
+    def __init__(self, output_dir, file_prefix, max_size, customer_id):
+        self.output_dir = output_dir
+        self.file_prefix = file_prefix
+        self.max_size = max_size
+        self.current_batch = {"customer_id": customer_id, "events": []}
+        self.batch_count = 0
+        self.ingested_batches = 0
+        os.makedirs(output_dir, exist_ok=True)
+    
+    def add_event(self, event):
+        self.current_batch["events"].append(event)
+        estimated_size = len(json.dumps(self.current_batch, indent=4).encode('utf-8'))
+        
+        if estimated_size >= self.max_size:
+            self.save_and_ingest_batch()
+    
+    def save_and_ingest_batch(self):
+        if not self.current_batch["events"]:
+            return
+            
+        self.batch_count += 1
+        filename = f"{self.file_prefix}_{self.batch_count}.json"
+        filepath = os.path.join(self.output_dir, filename)
+        
+        try:
+            # Save to local file
+            with open(filepath, "w", encoding="utf-8") as f:
+                json.dump(self.current_batch, f, indent=4)
+            logger.info(f"File saved: {filepath}")
+            
+            # Attempt to send to Google Cloud
+            response = send_events_to_google_cloud(self.current_batch)
+            if response and response.status_code == 200:
+                self.ingested_batches += 1
+            
+            # Reset the current batch
+            self.current_batch["events"] = []
+        
+        except IOError as e:
+            print(f"Error saving file: {e}")
+    
+    def finish(self):
+        if self.current_batch["events"]:
+            self.save_and_ingest_batch()
+
+def process_pcap(file_path, api_key=None):
+    """
+    Main function to process a PCAP file and generate events.
+    """
+    logger.info(f"Starting processing of PCAP file: {file_path}")
+    stats = ProcessingStats()
+    
+    customer_id = CUSTOMER_ID
+    reference_time = get_reference_timestamp()
+    capture = pyshark.FileCapture(file_path)
+    batcher = EventBatcher(OUTPUT_DIR, FILE_PREFIX, MAX_FILE_SIZE, customer_id)
+    
+    # Track both HTTP and TCP connections
+    http_connections: Dict[tuple, HTTPConnection] = {}
+    tcp_connections: Dict[tuple, TCPConnection] = {}
+    
+    try:
+        for packet in capture:
+            stats.packets_processed += 1
+            if stats.packets_processed % 1000 == 0:
+                logger.info(f"Processed {stats.packets_processed} packets...")
+
+            if not hasattr(packet, 'tcp'):
+                continue
+
+            try:
+                src_ip = packet.ip.src
+                dst_ip = packet.ip.dst
+                src_port = int(packet.tcp.srcport)
+                dst_port = int(packet.tcp.dstport)
+                
+                conn_key = (src_ip, src_port, dst_ip, dst_port)
+                rev_conn_key = (dst_ip, dst_port, src_ip, src_port)
+                
+                if 'HTTP' in packet:
+                    # Handle HTTP connections
+                    if conn_key in http_connections:
+                        conn = http_connections[conn_key]
+                    elif rev_conn_key in http_connections:
+                        conn = http_connections[rev_conn_key]
+                    else:
+                        conn = HTTPConnection(packet, reference_time)
+                        http_connections[conn_key] = conn
+                        stats.http_connections += 1
+                    
+                    conn.update_from_packet(packet)
+                    
+                    if conn.method and conn.response_code:
+                        event = conn.to_event()
+                        batcher.add_event(event)
+                        stats.events_generated += 1
+                        
+                        if conn_key in http_connections:
+                            del http_connections[conn_key]
+                        if rev_conn_key in http_connections:
+                            del http_connections[rev_conn_key]
+                else:
+                    # Handle TCP connections - update existing or create new
+                    if conn_key in tcp_connections:
+                        conn = tcp_connections[conn_key]
+                    elif rev_conn_key in tcp_connections:
+                        conn = tcp_connections[rev_conn_key]
+                    else:
+                        conn = TCPConnection(packet, reference_time)
+                        tcp_connections[conn_key] = conn
+                        stats.tcp_connections += 1
+                    
+                    conn.update_from_packet(packet)
+                
+            except AttributeError as e:
+                logger.error(f"Error processing packet: {e}")
+        
+        # Process remaining connections
+        for conn in list(http_connections.values()):
+            if conn.method:
+                event = conn.to_event()
+                batcher.add_event(event)
+                stats.events_generated += 1
+        
+        # Generate single event for each TCP connection
+        for conn in list(tcp_connections.values()):
+            event = conn.to_event()
+            batcher.add_event(event)
+            stats.events_generated += 1
+        
+    except Exception as e:
+        logger.error(f"Error during packet processing: {e}")
+    finally:
+        batcher.finish()
+        capture.close()
+        
+    logger.info(f"Process completed. Files saved in directory: {OUTPUT_DIR}")
+    logger.info(f"Total number of files created: {batcher.batch_count}")
+    logger.info(f"Total number of batches ingested: {batcher.ingested_batches}")
+    logger.info(f"Customer ID: {customer_id}")
+    
+    stats.print_summary()
+
+# Main execution block
+if __name__ == "__main__":
+    # Verify command line arguments
+    if len(sys.argv) < 3:
+        logger.error("Usage: python script.py <pcap_file> <timestamp>")
+        logger.error("Example: python script.py capture.pcap 2024-01-03T14:30:00Z")
+        sys.exit(1)
+        
+    pcap_file = sys.argv[1]
+    timestamp_str = sys.argv[2]
+
+    if not os.path.exists(pcap_file):
+        logger.error(f"PCAP file not found: {pcap_file}")
+        sys.exit(1)
+    
+    # Validate the timestamp
+    reference_time = validate_timestamp(timestamp_str)
+    if reference_time is None:
+        logger.error("Invalid timestamp format")
+        logger.error("Please use ISO 8601 format, e.g., 2024-01-03T14:30:00Z")
+        sys.exit(1)
+        
+    # Load configuration
+    config_file = 'config.conf'
+    config = load_config(config_file)
+    
+    if config:
+        CUSTOMER_ID = config.get("CUSTOMER_ID")
+        SERVICE_ACCOUNT_FILE = config.get("SERVICE_ACCOUNT_FILE")
+        logger.info(f"Using Customer ID: {CUSTOMER_ID}")
+    else:
+        logger.error("Failed to load configuration")
+        sys.exit(1)
+    
+    # Begin processing
+    process_pcap(pcap_file)
\ No newline at end of file
diff --git a/group17/code/requirements.txt b/group17/code/requirements.txt
new file mode 100644
index 0000000..3dfb75b
--- /dev/null
+++ b/group17/code/requirements.txt
@@ -0,0 +1,6 @@
+pyshark
+requests
+google-auth
+google-auth-oauthlib
+google-auth-httplib2
+python-dateutil
\ No newline at end of file
diff --git a/group17/docs/PARSER WIRESHARK FOR CHRONICLES.pptx b/group17/docs/PARSER WIRESHARK FOR CHRONICLES.pptx
new file mode 100644
index 0000000..42a00a5
Binary files /dev/null and b/group17/docs/PARSER WIRESHARK FOR CHRONICLES.pptx differ
diff --git a/group17/docs/report.pdf b/group17/docs/report.pdf
new file mode 100644
index 0000000..f307048
Binary files /dev/null and b/group17/docs/report.pdf differ