diff --git a/_modules/index.html b/_modules/index.html index e315603c..4fc2e3c8 100644 --- a/_modules/index.html +++ b/_modules/index.html @@ -5,14 +5,14 @@ - Overview: module code — parsedmarc 10.4.0 documentation + Overview: module code — parsedmarc 10.4.1 documentation - + diff --git a/_modules/parsedmarc.html b/_modules/parsedmarc.html index 3c480c8d..ab84550e 100644 --- a/_modules/parsedmarc.html +++ b/_modules/parsedmarc.html @@ -5,14 +5,14 @@ - parsedmarc — parsedmarc 10.4.0 documentation + parsedmarc — parsedmarc 10.4.1 documentation - + diff --git a/_modules/parsedmarc/config.html b/_modules/parsedmarc/config.html index 4e75979c..3d2e83bc 100644 --- a/_modules/parsedmarc/config.html +++ b/_modules/parsedmarc/config.html @@ -5,14 +5,14 @@ - parsedmarc.config — parsedmarc 10.4.0 documentation + parsedmarc.config — parsedmarc 10.4.1 documentation - + diff --git a/_modules/parsedmarc/elastic.html b/_modules/parsedmarc/elastic.html index fe082209..057eb296 100644 --- a/_modules/parsedmarc/elastic.html +++ b/_modules/parsedmarc/elastic.html @@ -5,14 +5,14 @@ - parsedmarc.elastic — parsedmarc 10.4.0 documentation + parsedmarc.elastic — parsedmarc 10.4.1 documentation - + @@ -102,6 +102,7 @@ Text, connections, ) +from elasticsearch.helpers import reindex from parsedmarc import InvalidFailureReport from parsedmarc.log import logger @@ -771,18 +772,67 @@ +_LEGACY_FO_FIELD = "published_policy.fo" +# The same field split into the object/leaf names a mapping body nests it +# under. Derived from the dotted name so the mapping written below cannot +# drift from the field _legacy_fo_field_type() reads. +_LEGACY_FO_OBJECT, _LEGACY_FO_LEAF = _LEGACY_FO_FIELD.split(".") + + +def _legacy_fo_field_type(index: Index) -> str | None: + """Return the mapped type of ``published_policy.fo`` in *index*. + + Returns ``None`` when the index does not map the field at all. + + Elasticsearch 6-era clusters keyed field mappings by the mapping type + name (``doc``); mapping types are gone from Elasticsearch 8, whose + responses put the field directly under ``mappings``. The type-keyed + shape is only descended into when such a key is actually present, so + this reads either shape. + + Args: + index (Index): The index to inspect. + + Returns: + str | None: The mapped field type, e.g. ``"long"`` or ``"text"``. + """ + response = index.get_field_mapping(fields=[_LEGACY_FO_FIELD]) + mappings = response[list(response.keys())[0]]["mappings"] + if _LEGACY_FO_FIELD not in mappings: + for type_name in ("doc", "_doc"): + if type_name in mappings: + mappings = mappings[type_name] + break + field_mapping = mappings.get(_LEGACY_FO_FIELD) + if not field_mapping: + return None + return field_mapping.get("mapping", {}).get(_LEGACY_FO_LEAF, {}).get("type") + +
[docs] def migrate_indexes( aggregate_indexes: list[str] | None = None, failure_indexes: list[str] | None = None, smtp_tls_indexes: list[str] | None = None, + legacy_fo_indexes: list[str] | None = None, ): """ - Backfills the ``dkim_results_combined``/``spf_results_combined`` fields - (added for issue #169) on aggregate report documents, and the - ``policies_combined``/``failure_details_combined`` fields on SMTP TLS - report documents, that were saved before those fields existed. + Runs index migrations and backfills. + + First, the legacy ``published_policy.fo`` migration, for each name in + ``legacy_fo_indexes``: parsedmarc releases before 5.0.0 declared that + field as an integer, so those indexes mapped it as ``long``, which + cannot hold the multi-value ``fo`` settings reports carry (``0:1``, + ``d:s``). Such an index is rebuilt as a ``-v2`` index with the + text/keyword shape, the documents are reindexed into it, and the + original is deleted. + + Second, it backfills the ``dkim_results_combined``/ + ``spf_results_combined`` fields (added for issue #169) on aggregate + report documents, and the ``policies_combined``/ + ``failure_details_combined`` fields on SMTP TLS report documents, that + were saved before those fields existed. For each name in ``aggregate_indexes``/``smtp_tls_indexes``, this submits an ``update_by_query`` against the ``f"{name}*"`` index pattern @@ -802,7 +852,72 @@ failure_indexes (list): A list of failure index names (accepted for API compatibility; unused) smtp_tls_indexes (list): A list of SMTP TLS index names + legacy_fo_indexes (list): A list of index names to check for the + pre-5.0.0 ``published_policy.fo`` ``long`` mapping. Unlike the + backfill arguments these are exact names, not patterns: + 5.0.0 introduced date-suffixed index names in the same release + that fixed the mapping, so an affected index has no date + component. It may still be prefixed or suffixed -- both + options date back to 4.1.0 -- so callers should pass the + names their own ``index_prefix``/``index_suffix`` + configuration produces. """ + if not aggregate_indexes and not smtp_tls_indexes and not legacy_fo_indexes: + return + + version = 2 + for legacy_index_name in legacy_fo_indexes or []: + try: + legacy_index = Index(legacy_index_name) + if not legacy_index.exists(): + continue + if _legacy_fo_field_type(legacy_index) != "long": + continue + new_index_name = f"{legacy_index_name}-v{version}" + # Nested object form rather than the dotted key this used to + # send. Both are accepted and produce an identical mapping + # (verified against Elasticsearch 8.19 and OpenSearch 3), but + # dot expansion is conditional on the object field's + # `subobjects` setting, and this shape never is. + properties = { + _LEGACY_FO_OBJECT: { + "properties": { + _LEGACY_FO_LEAF: { + "type": "text", + "fields": { + "keyword": {"type": "keyword", "ignore_above": 256} + }, + } + } + } + } + logger.info( + f"Migrating {legacy_index_name} to {new_index_name}: " + f"{_LEGACY_FO_FIELD} is mapped as long, as parsedmarc " + "releases before 5.0.0 declared it" + ) + # Reaching here means the original index still holds the data: + # it is deleted only after the reindex below succeeds. So a + # leftover target index is the debris of an earlier attempt + # that died between create() and delete(), and keeping it would + # fail every later attempt on "resource already exists". + if Index(new_index_name).exists(): + logger.warning( + f"Discarding {new_index_name} left behind by an earlier " + f"interrupted migration of {legacy_index_name}" + ) + Index(new_index_name).delete() + Index(new_index_name).create() + Index(new_index_name).put_mapping(properties=properties) + reindex(connections.get_connection(), legacy_index_name, new_index_name) + Index(legacy_index_name).delete() + except Exception as e: + logger.warning( + "Failed the legacy published_policy.fo migration for " + f"{legacy_index_name}: {e}. This will be retried at the " + "next startup." + ) + if not aggregate_indexes and not smtp_tls_indexes: return diff --git a/_modules/parsedmarc/opensearch.html b/_modules/parsedmarc/opensearch.html index bd653086..277d9be6 100644 --- a/_modules/parsedmarc/opensearch.html +++ b/_modules/parsedmarc/opensearch.html @@ -5,14 +5,14 @@ - parsedmarc.opensearch — parsedmarc 10.4.0 documentation + parsedmarc.opensearch — parsedmarc 10.4.1 documentation - + @@ -693,20 +693,61 @@ +_LEGACY_FO_FIELD = "published_policy.fo" +# The same field split into the object/leaf names a mapping body nests it +# under. Derived from the dotted name so the mapping written below cannot +# drift from the field _legacy_fo_field_type() reads. +_LEGACY_FO_OBJECT, _LEGACY_FO_LEAF = _LEGACY_FO_FIELD.split(".") + + +def _legacy_fo_field_type(index: Index) -> str | None: + """Return the mapped type of ``published_policy.fo`` in *index*. + + Returns ``None`` when the index does not map the field at all. + + Elasticsearch 6-era clusters keyed field mappings by the mapping type + name (``doc``); mapping types are gone from both OpenSearch and + Elasticsearch 8, whose responses put the field directly under + ``mappings``. The type-keyed shape is only descended into when such a + key is actually present, so this reads either shape. + + Args: + index (Index): The index to inspect. + + Returns: + str | None: The mapped field type, e.g. ``"long"`` or ``"text"``. + """ + response = index.get_field_mapping(fields=[_LEGACY_FO_FIELD]) + mappings = response[list(response.keys())[0]]["mappings"] + if _LEGACY_FO_FIELD not in mappings: + for type_name in ("doc", "_doc"): + if type_name in mappings: + mappings = mappings[type_name] + break + field_mapping = mappings.get(_LEGACY_FO_FIELD) + if not field_mapping: + return None + return field_mapping.get("mapping", {}).get(_LEGACY_FO_LEAF, {}).get("type") + +
[docs] def migrate_indexes( aggregate_indexes: list[str] | None = None, failure_indexes: list[str] | None = None, smtp_tls_indexes: list[str] | None = None, + legacy_fo_indexes: list[str] | None = None, ): """ Runs index migrations and backfills. - First, the legacy ``published_policy.fo`` migration: indexes where that - field was mapped as ``long`` (data indexed by very old parsedmarc - releases under the Elasticsearch 6-era ``doc`` mapping type) are rebuilt - as a ``-v2`` index with the text/keyword shape. + First, the legacy ``published_policy.fo`` migration, for each name in + ``legacy_fo_indexes``: parsedmarc releases before 5.0.0 declared that + field as an integer, so those indexes mapped it as ``long``, which + cannot hold the multi-value ``fo`` settings reports carry (``0:1``, + ``d:s``). Such an index is rebuilt as a ``-v2`` index with the + text/keyword shape, the documents are reindexed into it, and the + original is deleted. Second, the ``dkim_results_combined``/``spf_results_combined`` backfill (added for issue #169) for aggregate report documents that were saved @@ -733,51 +774,77 @@ (accepted for API compatibility; no migrations are currently needed for failure indexes) smtp_tls_indexes (list): A list of SMTP TLS index names + legacy_fo_indexes (list): A list of index names to check for the + pre-5.0.0 ``published_policy.fo`` ``long`` mapping. Unlike the + backfill arguments these are exact names, not patterns: + 5.0.0 introduced date-suffixed index names in the same release + that fixed the mapping, so an affected index has no date + component. It may still be prefixed or suffixed -- both + options date back to 4.1.0 -- so callers should pass the + names their own ``index_prefix``/``index_suffix`` + configuration produces. """ - if not aggregate_indexes and not smtp_tls_indexes: + if not aggregate_indexes and not smtp_tls_indexes and not legacy_fo_indexes: return version = 2 - for aggregate_index_name in aggregate_indexes or []: + for legacy_index_name in legacy_fo_indexes or []: try: - if not Index(aggregate_index_name).exists(): + legacy_index = Index(legacy_index_name) + if not legacy_index.exists(): continue - aggregate_index = Index(aggregate_index_name) - doc = "doc" - fo_field = "published_policy.fo" - fo = "fo" - fo_mapping = aggregate_index.get_field_mapping(fields=[fo_field]) - fo_mapping = fo_mapping[list(fo_mapping.keys())[0]]["mappings"] - if doc not in fo_mapping: + if _legacy_fo_field_type(legacy_index) != "long": continue - - fo_mapping = fo_mapping[doc][fo_field]["mapping"][fo] - fo_type = fo_mapping["type"] - if fo_type == "long": - new_index_name = f"{aggregate_index_name}-v{version}" - body = { - "properties": { - "published_policy.fo": { - "type": "text", - "fields": { - "keyword": {"type": "keyword", "ignore_above": 256} - }, + new_index_name = f"{legacy_index_name}-v{version}" + # Nested object form rather than the dotted key this used to + # send. Both are accepted and produce an identical mapping + # (verified against Elasticsearch 8.19 and OpenSearch 3), but + # dot expansion is conditional on the object field's + # `subobjects` setting, and this shape never is. + body = { + "properties": { + _LEGACY_FO_OBJECT: { + "properties": { + _LEGACY_FO_LEAF: { + "type": "text", + "fields": { + "keyword": {"type": "keyword", "ignore_above": 256} + }, + } } } } - Index(new_index_name).create() - Index(new_index_name).put_mapping(doc_type=doc, body=body) - reindex( - connections.get_connection(), aggregate_index_name, new_index_name + } + logger.info( + f"Migrating {legacy_index_name} to {new_index_name}: " + f"{_LEGACY_FO_FIELD} is mapped as long, as parsedmarc " + "releases before 5.0.0 declared it" + ) + # Reaching here means the original index still holds the data: + # it is deleted only after the reindex below succeeds. So a + # leftover target index is the debris of an earlier attempt + # that died between create() and delete(), and keeping it would + # fail every later attempt on "resource already exists". + if Index(new_index_name).exists(): + logger.warning( + f"Discarding {new_index_name} left behind by an earlier " + f"interrupted migration of {legacy_index_name}" ) - Index(aggregate_index_name).delete() + Index(new_index_name).delete() + Index(new_index_name).create() + Index(new_index_name).put_mapping(body=body) + reindex(connections.get_connection(), legacy_index_name, new_index_name) + Index(legacy_index_name).delete() except Exception as e: logger.warning( "Failed the legacy published_policy.fo migration for " - f"{aggregate_index_name}: {e}. This will be retried at the " + f"{legacy_index_name}: {e}. This will be retried at the " "next startup." ) + if not aggregate_indexes and not smtp_tls_indexes: + return + try: client = connections.get_connection() except Exception as e: diff --git a/_modules/parsedmarc/splunk.html b/_modules/parsedmarc/splunk.html index e2e53ae6..12e7ad45 100644 --- a/_modules/parsedmarc/splunk.html +++ b/_modules/parsedmarc/splunk.html @@ -5,14 +5,14 @@ - parsedmarc.splunk — parsedmarc 10.4.0 documentation + parsedmarc.splunk — parsedmarc 10.4.1 documentation - + diff --git a/_modules/parsedmarc/types.html b/_modules/parsedmarc/types.html index 6529583e..5d88381b 100644 --- a/_modules/parsedmarc/types.html +++ b/_modules/parsedmarc/types.html @@ -5,14 +5,14 @@ - parsedmarc.types — parsedmarc 10.4.0 documentation + parsedmarc.types — parsedmarc 10.4.1 documentation - + diff --git a/_modules/parsedmarc/utils.html b/_modules/parsedmarc/utils.html index 06759d90..af1de307 100644 --- a/_modules/parsedmarc/utils.html +++ b/_modules/parsedmarc/utils.html @@ -5,14 +5,14 @@ - parsedmarc.utils — parsedmarc 10.4.0 documentation + parsedmarc.utils — parsedmarc 10.4.1 documentation - + diff --git a/_sources/elasticsearch.md.txt b/_sources/elasticsearch.md.txt index 2d0a1a43..ef95fae9 100644 --- a/_sources/elasticsearch.md.txt +++ b/_sources/elasticsearch.md.txt @@ -247,6 +247,25 @@ OpenSearch. Any error talking to the cluster (for example, no indexes yet on a fresh install) is logged as a warning and retried on the next startup, rather than aborting parsedmarc. +Which index patterns it targets follows the ones parsedmarc writes to, and +is logged at debug level on startup: + +- With `index_prefix_domain_map` configured in `[general]` and no + `index_prefix` set, every tenant prefix in the map gets its own index + pattern, alongside the unprefixed one — aggregate and failure reports for + a domain that is not in the map are still saved without a prefix. A + configuration reload (`SIGHUP`) re-reads the map, so a newly onboarded + tenant is covered without a restart. +- With an `index_prefix` set in `[elasticsearch]`/`[opensearch]`, only that + prefix is targeted, and the map is not consulted. That is deliberate: such + a deployment writes only under its own prefix, and an `_update_by_query` + against a pattern it does not write to could reach another deployment's + data on a shared cluster. +- With an `index_suffix` set, both the suffixed and the unsuffixed pattern + are targeted, so documents indexed before the suffix was configured are + backfilled too. Note that the unsuffixed pattern also matches any *other* + suffix on the same cluster. + If you upgrade the dashboards without pointing the new parsedmarc version at the cluster, or you'd rather control when the write load happens, you can still run the backfill manually. It is idempotent (documents that @@ -314,7 +333,10 @@ curl -X POST "http://localhost:9200/dmarc_aggregate*/_update_by_query?conflicts= `wait_for_completion=false` returns a task ID — check progress with `GET _tasks/`. Adjust the index pattern if you use a custom -`index_prefix`/`index_suffix`. After backfilling, re-import the updated +`index_prefix`/`index_suffix`; with `index_prefix_domain_map`, run the +command once per tenant prefix (`acme_corp_dmarc_aggregate*`) plus once for +the unprefixed pattern, or widen it to `*dmarc_aggregate*` to cover every +tenant in one pass. After backfilling, re-import the updated dashboards ndjson (the index pattern saved object changed too) per the import instructions above. diff --git a/_sources/usage.md.txt b/_sources/usage.md.txt index e8374578..774985b3 100644 --- a/_sources/usage.md.txt +++ b/_sources/usage.md.txt @@ -127,7 +127,8 @@ The full set of configuration options are: Elasticsearch, Splunk and/or S3 - `save_smtp_tls` - bool: Save SMTP-STS report data to Elasticsearch, Splunk and/or S3 - - `index_prefix_domain_map` - bool: A path mapping of Opensearch/Elasticsearch index prefixes to domain names + - `index_prefix_domain_map` - str: Path to a YAML file mapping + OpenSearch/Elasticsearch index prefixes to domain names - `strip_attachment_payloads` - bool: Remove attachment payloads from results - `silent` - bool: Set this to `False` to output results to STDOUT @@ -1167,12 +1168,16 @@ whalensolutions: Save it to disk where the user running ParseDMARC can read it, then set `index_prefix_domain_map` to that filepath in the `[general]` section of the ParseDMARC configuration file and do not set an `index_prefix` option in the `[elasticsearch]` or `[opensearch]` sections. -When configured correctly, if ParseDMARC finds that a report is related to a domain in the mapping, the report will be saved in an index name that has the tenant name prefixed to it with a trailing underscore. Then, you can use the security features of Opensearch or the ELK stack to only grant users access to the indexes that they need. +When configured correctly, if ParseDMARC finds that a report is related to a domain in the mapping, the report will be saved in an index name that has the tenant name prefixed to it with a trailing underscore. Then, you can use the security features of OpenSearch or the ELK stack to only grant users access to the indexes that they need. :::{note} A domain cannot be used in multiple tenant lists. Only the first prefix list that contains the matching domain is used. ::: +Each key must be a tenant name and each value a *list* of domain names, all strings; a file of any other shape is rejected at startup. + +The index migrations and backfills that run at startup cover every tenant prefix in the map, in addition to the unprefixed indexes that hold reports for domains the map does not list. A configuration reload (`SIGHUP`) re-reads the map, so a newly onboarded tenant is covered without restarting parsedmarc. See [Backfilling the combined DKIM/SPF result fields](elasticsearch.md#backfilling-the-combined-dkimspf-result-fields) for the details. + ## Running parsedmarc as a systemd service Use systemd to run `parsedmarc` as a service and process reports as diff --git a/_static/documentation_options.js b/_static/documentation_options.js index 0c200b2d..f44b45e9 100644 --- a/_static/documentation_options.js +++ b/_static/documentation_options.js @@ -1,5 +1,5 @@ const DOCUMENTATION_OPTIONS = { - VERSION: '10.4.0', + VERSION: '10.4.1', LANGUAGE: 'en', COLLAPSE_INDEX: false, BUILDER: 'html', diff --git a/api.html b/api.html index e5d1beae..5d718a38 100644 --- a/api.html +++ b/api.html @@ -6,14 +6,14 @@ - API reference — parsedmarc 10.4.0 documentation + API reference — parsedmarc 10.4.1 documentation - + @@ -1283,11 +1283,20 @@ remaining keys are passed through; defaults are skipped entirely.

-parsedmarc.elastic.migrate_indexes(aggregate_indexes: list[str] | None = None, failure_indexes: list[str] | None = None, smtp_tls_indexes: list[str] | None = None)[source]
-

Backfills the dkim_results_combined/spf_results_combined fields -(added for issue #169) on aggregate report documents, and the -policies_combined/failure_details_combined fields on SMTP TLS -report documents, that were saved before those fields existed.

+parsedmarc.elastic.migrate_indexes(aggregate_indexes: list[str] | None = None, failure_indexes: list[str] | None = None, smtp_tls_indexes: list[str] | None = None, legacy_fo_indexes: list[str] | None = None)[source] +

Runs index migrations and backfills.

+

First, the legacy published_policy.fo migration, for each name in +legacy_fo_indexes: parsedmarc releases before 5.0.0 declared that +field as an integer, so those indexes mapped it as long, which +cannot hold the multi-value fo settings reports carry (0:1, +d:s). Such an index is rebuilt as a -v2 index with the +text/keyword shape, the documents are reindexed into it, and the +original is deleted.

+

Second, it backfills the dkim_results_combined/ +spf_results_combined fields (added for issue #169) on aggregate +report documents, and the policies_combined/ +failure_details_combined fields on SMTP TLS report documents, that +were saved before those fields existed.

For each name in aggregate_indexes/smtp_tls_indexes, this submits an update_by_query against the f"{name}*" index pattern (the real indexes are date-suffixed) as a non-blocking background task @@ -1307,6 +1316,15 @@ next startup, and the manual

failure_indexes (list) – A list of failure index names (accepted for API compatibility; unused)

  • smtp_tls_indexes (list) – A list of SMTP TLS index names

    • +

  • legacy_fo_indexes (list) – A list of index names to check for the +pre-5.0.0 published_policy.fo long mapping. Unlike the +backfill arguments these are exact names, not patterns: +5.0.0 introduced date-suffixed index names in the same release +that fixed the mapping, so an affected index has no date +component. It may still be prefixed or suffixed – both +options date back to 4.1.0 – so callers should pass the +names their own index_prefix/index_suffix +configuration produces.

    • @@ -1457,12 +1475,15 @@ any other settings through unchanged.

    -parsedmarc.opensearch.migrate_indexes(aggregate_indexes: list[str] | None = None, failure_indexes: list[str] | None = None, smtp_tls_indexes: list[str] | None = None)[source]
    +parsedmarc.opensearch.migrate_indexes(aggregate_indexes: list[str] | None = None, failure_indexes: list[str] | None = None, smtp_tls_indexes: list[str] | None = None, legacy_fo_indexes: list[str] | None = None)[source]

    Runs index migrations and backfills.

    -

    First, the legacy published_policy.fo migration: indexes where that -field was mapped as long (data indexed by very old parsedmarc -releases under the Elasticsearch 6-era doc mapping type) are rebuilt -as a -v2 index with the text/keyword shape.

    +

    First, the legacy published_policy.fo migration, for each name in +legacy_fo_indexes: parsedmarc releases before 5.0.0 declared that +field as an integer, so those indexes mapped it as long, which +cannot hold the multi-value fo settings reports carry (0:1, +d:s). Such an index is rebuilt as a -v2 index with the +text/keyword shape, the documents are reindexed into it, and the +original is deleted.

    Second, the dkim_results_combined/spf_results_combined backfill (added for issue #169) for aggregate report documents that were saved before those fields existed. For each name in aggregate_indexes, @@ -1488,6 +1509,15 @@ report documents, for each name in

  • smtp_tls_indexes (list) – A list of SMTP TLS index names

    • +

  • legacy_fo_indexes (list) – A list of index names to check for the +pre-5.0.0 published_policy.fo long mapping. Unlike the +backfill arguments these are exact names, not patterns: +5.0.0 introduced date-suffixed index names in the same release +that fixed the mapping, so an affected index has no date +component. It may still be prefixed or suffixed – both +options date back to 4.1.0 – so callers should pass the +names their own index_prefix/index_suffix +configuration produces.

    • diff --git a/contributing.html b/contributing.html index 0a569907..6abadebf 100644 --- a/contributing.html +++ b/contributing.html @@ -6,14 +6,14 @@ - Contributing to parsedmarc — parsedmarc 10.4.0 documentation + Contributing to parsedmarc — parsedmarc 10.4.1 documentation - + diff --git a/davmail.html b/davmail.html index e0895c5c..ac57a81a 100644 --- a/davmail.html +++ b/davmail.html @@ -6,14 +6,14 @@ - Accessing an inbox using OWA/EWS — parsedmarc 10.4.0 documentation + Accessing an inbox using OWA/EWS — parsedmarc 10.4.1 documentation - + diff --git a/dmarc.html b/dmarc.html index 1d3cc5b0..94ff59f9 100644 --- a/dmarc.html +++ b/dmarc.html @@ -6,14 +6,14 @@ - Understanding DMARC — parsedmarc 10.4.0 documentation + Understanding DMARC — parsedmarc 10.4.1 documentation - + diff --git a/elasticsearch.html b/elasticsearch.html index 5bd57612..5f5620da 100644 --- a/elasticsearch.html +++ b/elasticsearch.html @@ -6,14 +6,14 @@ - Elasticsearch and Kibana — parsedmarc 10.4.0 documentation + Elasticsearch and Kibana — parsedmarc 10.4.1 documentation - + @@ -284,6 +284,25 @@ count of 0 and log nothing further — and it works the same way on OpenSearch. Any error talking to the cluster (for example, no indexes yet on a fresh install) is logged as a warning and retried on the next startup, rather than aborting parsedmarc.

    +

    Which index patterns it targets follows the ones parsedmarc writes to, and +is logged at debug level on startup:

    +
      +

    • With index_prefix_domain_map configured in [general] and no +index_prefix set, every tenant prefix in the map gets its own index +pattern, alongside the unprefixed one — aggregate and failure reports for +a domain that is not in the map are still saved without a prefix. A +configuration reload (SIGHUP) re-reads the map, so a newly onboarded +tenant is covered without a restart.

      • +

    • With an index_prefix set in [elasticsearch]/[opensearch], only that +prefix is targeted, and the map is not consulted. That is deliberate: such +a deployment writes only under its own prefix, and an _update_by_query +against a pattern it does not write to could reach another deployment’s +data on a shared cluster.

      • +

    • With an index_suffix set, both the suffixed and the unsuffixed pattern +are targeted, so documents indexed before the suffix was configured are +backfilled too. Note that the unsuffixed pattern also matches any other +suffix on the same cluster.

      • +

    If you upgrade the dashboards without pointing the new parsedmarc version at the cluster, or you’d rather control when the write load happens, you can still run the backfill manually. It is idempotent (documents that @@ -349,7 +368,10 @@ no backfillable document is skipped.

    wait_for_completion=false returns a task ID — check progress with GET _tasks/<task id>. Adjust the index pattern if you use a custom -index_prefix/index_suffix. After backfilling, re-import the updated +index_prefix/index_suffix; with index_prefix_domain_map, run the +command once per tenant prefix (acme_corp_dmarc_aggregate*) plus once for +the unprefixed pattern, or widen it to *dmarc_aggregate* to cover every +tenant in one pass. After backfilling, re-import the updated dashboards ndjson (the index pattern saved object changed too) per the import instructions above.

    SMTP TLS documents have the same class of defect one level deeper: diff --git a/genindex.html b/genindex.html index d041b6cf..0219ed09 100644 --- a/genindex.html +++ b/genindex.html @@ -5,14 +5,14 @@ - Index — parsedmarc 10.4.0 documentation + Index — parsedmarc 10.4.1 documentation - + diff --git a/index.html b/index.html index 4cefca83..2c0f2125 100644 --- a/index.html +++ b/index.html @@ -6,14 +6,14 @@ - parsedmarc documentation - Open source DMARC report analyzer and visualizer — parsedmarc 10.4.0 documentation + parsedmarc documentation - Open source DMARC report analyzer and visualizer — parsedmarc 10.4.1 documentation - + diff --git a/installation.html b/installation.html index a9ac91ea..465e201e 100644 --- a/installation.html +++ b/installation.html @@ -6,14 +6,14 @@ - Installation — parsedmarc 10.4.0 documentation + Installation — parsedmarc 10.4.1 documentation - + diff --git a/kibana.html b/kibana.html index 1ee20c1d..730c55a3 100644 --- a/kibana.html +++ b/kibana.html @@ -6,14 +6,14 @@ - Using the Kibana dashboards — parsedmarc 10.4.0 documentation + Using the Kibana dashboards — parsedmarc 10.4.1 documentation - + diff --git a/mailing-lists.html b/mailing-lists.html index 6764a3bb..7a3400a4 100644 --- a/mailing-lists.html +++ b/mailing-lists.html @@ -6,14 +6,14 @@ - What about mailing lists? — parsedmarc 10.4.0 documentation + What about mailing lists? — parsedmarc 10.4.1 documentation - + diff --git a/objects.inv b/objects.inv index b55c6ef7..e05a6e64 100644 Binary files a/objects.inv and b/objects.inv differ diff --git a/opensearch.html b/opensearch.html index 0d65d22b..43e2745c 100644 --- a/opensearch.html +++ b/opensearch.html @@ -6,14 +6,14 @@ - OpenSearch and Grafana — parsedmarc 10.4.0 documentation + OpenSearch and Grafana — parsedmarc 10.4.1 documentation - + diff --git a/output.html b/output.html index b265c6ab..755f9faa 100644 --- a/output.html +++ b/output.html @@ -6,14 +6,14 @@ - Sample outputs — parsedmarc 10.4.0 documentation + Sample outputs — parsedmarc 10.4.1 documentation - + diff --git a/py-modindex.html b/py-modindex.html index 020ba717..569eae60 100644 --- a/py-modindex.html +++ b/py-modindex.html @@ -5,14 +5,14 @@ - Python Module Index — parsedmarc 10.4.0 documentation + Python Module Index — parsedmarc 10.4.1 documentation - + diff --git a/search.html b/search.html index c2d4ed86..fbdc1132 100644 --- a/search.html +++ b/search.html @@ -5,7 +5,7 @@ - Search — parsedmarc 10.4.0 documentation + Search — parsedmarc 10.4.1 documentation @@ -13,7 +13,7 @@ - + diff --git a/searchindex.js b/searchindex.js index dd8e5d47..2a3ae122 100644 --- a/searchindex.js +++ b/searchindex.js @@ -1 +1 @@ -Search.setIndex({"alltitles":{"API reference":[[0,null]],"Accessing an inbox using OWA/EWS":[[2,null]],"Backfilling the combined DKIM/SPF result fields":[[4,"backfilling-the-combined-dkim-spf-result-fields"]],"Bug reports":[[1,"bug-reports"]],"CLI help":[[12,"cli-help"]],"CSV aggregate report":[[10,"csv-aggregate-report"]],"CSV failure report":[[10,"csv-failure-report"]],"Configuration file":[[12,"configuration-file"]],"Configuring parsedmarc for DavMail":[[2,"configuring-parsedmarc-for-davmail"]],"Contents":[[5,null]],"Contributing to parsedmarc":[[1,null]],"DMARC Alignment Guide":[[3,"dmarc-alignment-guide"]],"DMARC aggregate reports":[[7,"dmarc-aggregate-reports"]],"DMARC failure reports":[[7,"dmarc-failure-reports"]],"DMARC guides":[[3,"dmarc-guides"]],"Do":[[3,"do"],[8,"do"]],"Do not":[[3,"do-not"],[8,"do-not"]],"Docker Compose example":[[12,"docker-compose-example"]],"Docker secrets (_FILE suffix)":[[12,"docker-secrets-file-suffix"]],"Elasticsearch and Kibana":[[4,null]],"Environment variable configuration":[[12,"environment-variable-configuration"]],"Examples":[[12,"examples"]],"Features":[[5,"features"]],"IP-to-country database":[[6,"ip-to-country-database"]],"Indices and tables":[[0,"indices-and-tables"]],"Installation":[[4,"installation"],[6,null],[9,"installation"]],"Installing parsedmarc":[[6,"installing-parsedmarc"]],"JSON SMTP TLS report":[[10,"json-smtp-tls-report"]],"JSON aggregate report":[[10,"json-aggregate-report"]],"JSON failure report":[[10,"json-failure-report"]],"LISTSERV":[[3,"listserv"],[8,"listserv"]],"Lookalike domains":[[3,"lookalike-domains"]],"Mailbox messages are only archived once the reports are saved":[[12,"mailbox-messages-are-only-archived-once-the-reports-are-saved"]],"Mailing list best practices":[[3,"mailing-list-best-practices"],[8,"mailing-list-best-practices"]],"Mailman 2":[[3,"mailman-2"],[3,"id1"],[8,"mailman-2"],[8,"id1"]],"Mailman 3":[[3,"mailman-3"],[3,"id2"],[8,"mailman-3"],[8,"id2"]],"Multi-tenant support":[[12,"multi-tenant-support"]],"OpenSearch and Grafana":[[9,null]],"Optional dependencies":[[6,"optional-dependencies"]],"Performance tuning":[[12,"performance-tuning"]],"Prerequisites":[[6,"prerequisites"]],"Python Compatibility":[[5,"python-compatibility"]],"Records retention":[[4,"records-retention"],[9,"records-retention"]],"Reloading configuration without restarting":[[12,"reloading-configuration-without-restarting"]],"Resources":[[3,"resources"]],"Running DavMail as a systemd service":[[2,"running-davmail-as-a-systemd-service"]],"Running parsedmarc as a systemd service":[[12,"running-parsedmarc-as-a-systemd-service"]],"Running without a config file (env-only mode)":[[12,"running-without-a-config-file-env-only-mode"]],"SMTP TLS reporting":[[7,"smtp-tls-reporting"]],"SPF and DMARC record validation":[[3,"spf-and-dmarc-record-validation"]],"Sample aggregate report output":[[10,"sample-aggregate-report-output"]],"Sample failure report output":[[10,"sample-failure-report-output"]],"Sample outputs":[[10,null]],"Section name mapping":[[12,"section-name-mapping"]],"Specifying the config file via environment variable":[[12,"specifying-the-config-file-via-environment-variable"]],"Splunk":[[11,null]],"Testing multiple report analyzers":[[6,"testing-multiple-report-analyzers"]],"Understanding DMARC":[[3,null]],"Upgrading Kibana index patterns":[[4,"upgrading-kibana-index-patterns"]],"Using MaxMind GeoLite2 (optional)":[[6,"using-maxmind-geolite2-optional"]],"Using Microsoft Exchange":[[6,"using-microsoft-exchange"]],"Using a web proxy":[[6,"using-a-web-proxy"]],"Using parsedmarc":[[12,null]],"Using parsedmarc as a library":[[12,"using-parsedmarc-as-a-library"]],"Using the Kibana dashboards":[[7,null]],"What about mailing lists?":[[3,"what-about-mailing-lists"],[8,null]],"What if a sender won\u2019t support DKIM/DMARC?":[[3,"what-if-a-sender-wont-support-dkim-dmarc"]],"Workarounds":[[3,"workarounds"],[8,"workarounds"]],"parsedmarc":[[0,"module-parsedmarc"]],"parsedmarc documentation - Open source DMARC report analyzer and visualizer":[[5,null]],"parsedmarc.config":[[0,"module-parsedmarc.config"]],"parsedmarc.elastic":[[0,"module-parsedmarc.elastic"]],"parsedmarc.opensearch":[[0,"module-parsedmarc.opensearch"]],"parsedmarc.splunk":[[0,"module-parsedmarc.splunk"]],"parsedmarc.types":[[0,"module-parsedmarc.types"]],"parsedmarc.utils":[[0,"module-parsedmarc.utils"]]},"docnames":["api","contributing","davmail","dmarc","elasticsearch","index","installation","kibana","mailing-lists","opensearch","output","splunk","usage"],"envversion":{"sphinx":66,"sphinx.domains.c":3,"sphinx.domains.changeset":1,"sphinx.domains.citation":1,"sphinx.domains.cpp":9,"sphinx.domains.index":1,"sphinx.domains.javascript":3,"sphinx.domains.math":2,"sphinx.domains.python":4,"sphinx.domains.rst":2,"sphinx.domains.std":2,"sphinx.ext.todo":2,"sphinx.ext.viewcode":1},"filenames":["api.md","contributing.md","davmail.md","dmarc.md","elasticsearch.md","index.md","installation.md","kibana.md","mailing-lists.md","opensearch.md","output.md","splunk.md","usage.md"],"indexentries":{"aggregatealignment (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAlignment",false]],"aggregateauthresultdkim (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResultDKIM",false]],"aggregateauthresults (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResults",false]],"aggregateauthresultspf (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResultSPF",false]],"aggregateidentifiers (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateIdentifiers",false]],"aggregateparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateParsedReport",false]],"aggregatepolicyevaluated (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyEvaluated",false]],"aggregatepolicyoverridereason (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyOverrideReason",false]],"aggregatepolicypublished (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyPublished",false]],"aggregaterecord (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateRecord",false]],"aggregatereport (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateReport",false]],"aggregatereportmetadata (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateReportMetadata",false]],"alreadysaved":[[0,"parsedmarc.elastic.AlreadySaved",false],[0,"parsedmarc.opensearch.AlreadySaved",false]],"always_use_local_files (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.always_use_local_files",false]],"append_json() (in module parsedmarc)":[[0,"parsedmarc.append_json",false]],"close() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.close",false]],"configure_ipinfo_api() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.configure_ipinfo_api",false]],"convert_outlook_msg() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.convert_outlook_msg",false]],"create_indexes() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.create_indexes",false]],"create_indexes() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.create_indexes",false]],"decode_base64() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.decode_base64",false]],"dns_retries (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.dns_retries",false]],"dns_timeout (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.dns_timeout",false]],"downloaderror":[[0,"parsedmarc.utils.DownloadError",false]],"elasticsearcherror":[[0,"parsedmarc.elastic.ElasticsearchError",false]],"email_results() (in module parsedmarc)":[[0,"parsedmarc.email_results",false]],"email_results_via_msgraph() (in module parsedmarc)":[[0,"parsedmarc.email_results_via_msgraph",false]],"emailaddress (class in parsedmarc.types)":[[0,"parsedmarc.types.EmailAddress",false]],"emailattachment (class in parsedmarc.types)":[[0,"parsedmarc.types.EmailAttachment",false]],"emailparsererror":[[0,"parsedmarc.utils.EmailParserError",false]],"extract_report() (in module parsedmarc)":[[0,"parsedmarc.extract_report",false]],"extract_report_from_file_path() (in module parsedmarc)":[[0,"parsedmarc.extract_report_from_file_path",false]],"failureparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.FailureParsedReport",false]],"failurereport (class in parsedmarc.types)":[[0,"parsedmarc.types.FailureReport",false]],"forensicparsedreport (in module parsedmarc.types)":[[0,"parsedmarc.types.ForensicParsedReport",false]],"forensicreport (in module parsedmarc.types)":[[0,"parsedmarc.types.ForensicReport",false]],"get_base_domain() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_base_domain",false]],"get_dmarc_reports_from_mailbox() (in module parsedmarc)":[[0,"parsedmarc.get_dmarc_reports_from_mailbox",false]],"get_dmarc_reports_from_mbox() (in module parsedmarc)":[[0,"parsedmarc.get_dmarc_reports_from_mbox",false]],"get_filename_safe_string() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_filename_safe_string",false]],"get_ip_address_country() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_country",false]],"get_ip_address_db_record() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_db_record",false]],"get_ip_address_info() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_info",false]],"get_report_zip() (in module parsedmarc)":[[0,"parsedmarc.get_report_zip",false]],"get_reverse_dns() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_reverse_dns",false]],"get_service_from_reverse_dns_base_domain() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_service_from_reverse_dns_base_domain",false]],"hecclient (class in parsedmarc.splunk)":[[0,"parsedmarc.splunk.HECClient",false]],"human_timestamp_to_datetime() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.human_timestamp_to_datetime",false]],"human_timestamp_to_unix_timestamp() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.human_timestamp_to_unix_timestamp",false]],"invalidaggregatereport":[[0,"parsedmarc.InvalidAggregateReport",false]],"invaliddmarcreport":[[0,"parsedmarc.InvalidDMARCReport",false]],"invalidfailurereport":[[0,"parsedmarc.InvalidFailureReport",false]],"invalidforensicreport (in module parsedmarc)":[[0,"parsedmarc.InvalidForensicReport",false]],"invalidipinfoapikey":[[0,"parsedmarc.utils.InvalidIPinfoAPIKey",false]],"invalidsmtptlsreport":[[0,"parsedmarc.InvalidSMTPTLSReport",false]],"ip_address_cache (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.ip_address_cache",false]],"ip_db_path (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.ip_db_path",false]],"ipaddressinfo (class in parsedmarc.utils)":[[0,"parsedmarc.utils.IPAddressInfo",false]],"ipsourceinfo (class in parsedmarc.types)":[[0,"parsedmarc.types.IPSourceInfo",false]],"is_mbox() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.is_mbox",false]],"is_outlook_msg() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.is_outlook_msg",false]],"load_ip_db() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_ip_db",false]],"load_psl_overrides() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_psl_overrides",false]],"load_reverse_dns_map() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_reverse_dns_map",false]],"migrate_indexes() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.migrate_indexes",false]],"migrate_indexes() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.migrate_indexes",false]],"module":[[0,"module-parsedmarc",false],[0,"module-parsedmarc.config",false],[0,"module-parsedmarc.elastic",false],[0,"module-parsedmarc.opensearch",false],[0,"module-parsedmarc.splunk",false],[0,"module-parsedmarc.types",false],[0,"module-parsedmarc.utils",false]],"nameservers (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.nameservers",false]],"normalize_timespan_threshold_hours (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.normalize_timespan_threshold_hours",false]],"offline (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.offline",false]],"opensearcherror":[[0,"parsedmarc.opensearch.OpenSearchError",false]],"parse_aggregate_report_file() (in module parsedmarc)":[[0,"parsedmarc.parse_aggregate_report_file",false]],"parse_aggregate_report_xml() (in module parsedmarc)":[[0,"parsedmarc.parse_aggregate_report_xml",false]],"parse_email() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.parse_email",false]],"parse_failure_report() (in module parsedmarc)":[[0,"parsedmarc.parse_failure_report",false]],"parse_forensic_report() (in module parsedmarc)":[[0,"parsedmarc.parse_forensic_report",false]],"parse_report_email() (in module parsedmarc)":[[0,"parsedmarc.parse_report_email",false]],"parse_report_file() (in module parsedmarc)":[[0,"parsedmarc.parse_report_file",false]],"parse_smtp_tls_report_json() (in module parsedmarc)":[[0,"parsedmarc.parse_smtp_tls_report_json",false]],"parsed_aggregate_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_aggregate_reports_to_csv",false]],"parsed_aggregate_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_aggregate_reports_to_csv_rows",false]],"parsed_failure_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_failure_reports_to_csv",false]],"parsed_failure_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_failure_reports_to_csv_rows",false]],"parsed_forensic_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_forensic_reports_to_csv",false]],"parsed_forensic_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_forensic_reports_to_csv_rows",false]],"parsed_smtp_tls_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_smtp_tls_reports_to_csv",false]],"parsed_smtp_tls_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_smtp_tls_reports_to_csv_rows",false]],"parsedemail (class in parsedmarc.types)":[[0,"parsedmarc.types.ParsedEmail",false]],"parsedmarc":[[0,"module-parsedmarc",false]],"parsedmarc.config":[[0,"module-parsedmarc.config",false]],"parsedmarc.elastic":[[0,"module-parsedmarc.elastic",false]],"parsedmarc.opensearch":[[0,"module-parsedmarc.opensearch",false]],"parsedmarc.splunk":[[0,"module-parsedmarc.splunk",false]],"parsedmarc.types":[[0,"module-parsedmarc.types",false]],"parsedmarc.utils":[[0,"module-parsedmarc.utils",false]],"parserconfig (class in parsedmarc.config)":[[0,"parsedmarc.config.ParserConfig",false]],"parsererror":[[0,"parsedmarc.ParserError",false]],"parsingresults (class in parsedmarc.types)":[[0,"parsedmarc.types.ParsingResults",false]],"psl_overrides_path (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.psl_overrides_path",false]],"psl_overrides_url (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.psl_overrides_url",false]],"query_dns() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.query_dns",false]],"reverse_dns_map (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.reverse_dns_map",false]],"reverse_dns_map_path (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.reverse_dns_map_path",false]],"reverse_dns_map_url (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.reverse_dns_map_url",false]],"reversednsservice (class in parsedmarc.utils)":[[0,"parsedmarc.utils.ReverseDNSService",false]],"save_aggregate_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_aggregate_report_to_elasticsearch",false]],"save_aggregate_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_aggregate_report_to_opensearch",false]],"save_aggregate_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_aggregate_reports_to_splunk",false]],"save_failure_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_failure_report_to_elasticsearch",false]],"save_failure_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_failure_report_to_opensearch",false]],"save_failure_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_failure_reports_to_splunk",false]],"save_forensic_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_forensic_report_to_elasticsearch",false]],"save_forensic_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_forensic_report_to_opensearch",false]],"save_forensic_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_forensic_reports_to_splunk",false]],"save_output() (in module parsedmarc)":[[0,"parsedmarc.save_output",false]],"save_smtp_tls_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_smtp_tls_report_to_elasticsearch",false]],"save_smtp_tls_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_smtp_tls_report_to_opensearch",false]],"save_smtp_tls_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_smtp_tls_reports_to_splunk",false]],"seen_aggregate_report_ids (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.seen_aggregate_report_ids",false]],"set_hosts() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.set_hosts",false]],"set_hosts() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.set_hosts",false]],"smtptlsfailuredetails (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSFailureDetails",false]],"smtptlsfailuredetailsoptional (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSFailureDetailsOptional",false]],"smtptlsparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSParsedReport",false]],"smtptlspolicy (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSPolicy",false]],"smtptlspolicysummary (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSPolicySummary",false]],"smtptlsreport (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSReport",false]],"splunkerror":[[0,"parsedmarc.splunk.SplunkError",false]],"strip_attachment_payloads (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.strip_attachment_payloads",false]],"timestamp_to_datetime() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.timestamp_to_datetime",false]],"timestamp_to_human() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.timestamp_to_human",false]],"watch_inbox() (in module parsedmarc)":[[0,"parsedmarc.watch_inbox",false]]},"objects":{"":[[0,0,0,"-","parsedmarc"]],"parsedmarc":[[0,1,1,"","InvalidAggregateReport"],[0,1,1,"","InvalidDMARCReport"],[0,1,1,"","InvalidFailureReport"],[0,2,1,"","InvalidForensicReport"],[0,1,1,"","InvalidSMTPTLSReport"],[0,1,1,"","ParserError"],[0,3,1,"","append_json"],[0,0,0,"-","config"],[0,0,0,"-","elastic"],[0,3,1,"","email_results"],[0,3,1,"","email_results_via_msgraph"],[0,3,1,"","extract_report"],[0,3,1,"","extract_report_from_file_path"],[0,3,1,"","get_dmarc_reports_from_mailbox"],[0,3,1,"","get_dmarc_reports_from_mbox"],[0,3,1,"","get_report_zip"],[0,0,0,"-","opensearch"],[0,3,1,"","parse_aggregate_report_file"],[0,3,1,"","parse_aggregate_report_xml"],[0,3,1,"","parse_failure_report"],[0,3,1,"","parse_forensic_report"],[0,3,1,"","parse_report_email"],[0,3,1,"","parse_report_file"],[0,3,1,"","parse_smtp_tls_report_json"],[0,3,1,"","parsed_aggregate_reports_to_csv"],[0,3,1,"","parsed_aggregate_reports_to_csv_rows"],[0,3,1,"","parsed_failure_reports_to_csv"],[0,3,1,"","parsed_failure_reports_to_csv_rows"],[0,3,1,"","parsed_forensic_reports_to_csv"],[0,3,1,"","parsed_forensic_reports_to_csv_rows"],[0,3,1,"","parsed_smtp_tls_reports_to_csv"],[0,3,1,"","parsed_smtp_tls_reports_to_csv_rows"],[0,3,1,"","save_output"],[0,0,0,"-","splunk"],[0,0,0,"-","types"],[0,0,0,"-","utils"],[0,3,1,"","watch_inbox"]],"parsedmarc.config":[[0,4,1,"","ParserConfig"]],"parsedmarc.config.ParserConfig":[[0,2,1,"","always_use_local_files"],[0,2,1,"","dns_retries"],[0,2,1,"","dns_timeout"],[0,2,1,"","ip_address_cache"],[0,2,1,"","ip_db_path"],[0,2,1,"","nameservers"],[0,2,1,"","normalize_timespan_threshold_hours"],[0,2,1,"","offline"],[0,2,1,"","psl_overrides_path"],[0,2,1,"","psl_overrides_url"],[0,2,1,"","reverse_dns_map"],[0,2,1,"","reverse_dns_map_path"],[0,2,1,"","reverse_dns_map_url"],[0,2,1,"","seen_aggregate_report_ids"],[0,2,1,"","strip_attachment_payloads"]],"parsedmarc.elastic":[[0,1,1,"","AlreadySaved"],[0,1,1,"","ElasticsearchError"],[0,3,1,"","create_indexes"],[0,3,1,"","migrate_indexes"],[0,3,1,"","save_aggregate_report_to_elasticsearch"],[0,3,1,"","save_failure_report_to_elasticsearch"],[0,3,1,"","save_forensic_report_to_elasticsearch"],[0,3,1,"","save_smtp_tls_report_to_elasticsearch"],[0,3,1,"","set_hosts"]],"parsedmarc.opensearch":[[0,1,1,"","AlreadySaved"],[0,1,1,"","OpenSearchError"],[0,3,1,"","create_indexes"],[0,3,1,"","migrate_indexes"],[0,3,1,"","save_aggregate_report_to_opensearch"],[0,3,1,"","save_failure_report_to_opensearch"],[0,3,1,"","save_forensic_report_to_opensearch"],[0,3,1,"","save_smtp_tls_report_to_opensearch"],[0,3,1,"","set_hosts"]],"parsedmarc.splunk":[[0,4,1,"","HECClient"],[0,1,1,"","SplunkError"]],"parsedmarc.splunk.HECClient":[[0,5,1,"","close"],[0,5,1,"","save_aggregate_reports_to_splunk"],[0,5,1,"","save_failure_reports_to_splunk"],[0,5,1,"","save_forensic_reports_to_splunk"],[0,5,1,"","save_smtp_tls_reports_to_splunk"]],"parsedmarc.types":[[0,4,1,"","AggregateAlignment"],[0,4,1,"","AggregateAuthResultDKIM"],[0,4,1,"","AggregateAuthResultSPF"],[0,4,1,"","AggregateAuthResults"],[0,4,1,"","AggregateIdentifiers"],[0,4,1,"","AggregateParsedReport"],[0,4,1,"","AggregatePolicyEvaluated"],[0,4,1,"","AggregatePolicyOverrideReason"],[0,4,1,"","AggregatePolicyPublished"],[0,4,1,"","AggregateRecord"],[0,4,1,"","AggregateReport"],[0,4,1,"","AggregateReportMetadata"],[0,4,1,"","EmailAddress"],[0,4,1,"","EmailAttachment"],[0,4,1,"","FailureParsedReport"],[0,4,1,"","FailureReport"],[0,2,1,"","ForensicParsedReport"],[0,2,1,"","ForensicReport"],[0,4,1,"","IPSourceInfo"],[0,4,1,"","ParsedEmail"],[0,4,1,"","ParsingResults"],[0,4,1,"","SMTPTLSFailureDetails"],[0,4,1,"","SMTPTLSFailureDetailsOptional"],[0,4,1,"","SMTPTLSParsedReport"],[0,4,1,"","SMTPTLSPolicy"],[0,4,1,"","SMTPTLSPolicySummary"],[0,4,1,"","SMTPTLSReport"]],"parsedmarc.utils":[[0,1,1,"","DownloadError"],[0,1,1,"","EmailParserError"],[0,4,1,"","IPAddressInfo"],[0,1,1,"","InvalidIPinfoAPIKey"],[0,4,1,"","ReverseDNSService"],[0,3,1,"","configure_ipinfo_api"],[0,3,1,"","convert_outlook_msg"],[0,3,1,"","decode_base64"],[0,3,1,"","get_base_domain"],[0,3,1,"","get_filename_safe_string"],[0,3,1,"","get_ip_address_country"],[0,3,1,"","get_ip_address_db_record"],[0,3,1,"","get_ip_address_info"],[0,3,1,"","get_reverse_dns"],[0,3,1,"","get_service_from_reverse_dns_base_domain"],[0,3,1,"","human_timestamp_to_datetime"],[0,3,1,"","human_timestamp_to_unix_timestamp"],[0,3,1,"","is_mbox"],[0,3,1,"","is_outlook_msg"],[0,3,1,"","load_ip_db"],[0,3,1,"","load_psl_overrides"],[0,3,1,"","load_reverse_dns_map"],[0,3,1,"","parse_email"],[0,3,1,"","query_dns"],[0,3,1,"","timestamp_to_datetime"],[0,3,1,"","timestamp_to_human"]]},"objnames":{"0":["py","module","Python module"],"1":["py","exception","Python exception"],"2":["py","attribute","Python attribute"],"3":["py","function","Python function"],"4":["py","class","Python class"],"5":["py","method","Python method"]},"objtypes":{"0":"py:module","1":"py:exception","2":"py:attribute","3":"py:function","4":"py:class","5":"py:method"},"terms":{"00z":10,"00z_exampl":10,"09t00":10,"09t23":10,"1d":12,"1g":4,"1w":12,"2017a":[3,8],"21vianet":12,"2d":12,"2k":12,"30s":12,"3d":10,"3h":12,"59z":10,"5m":[2,12],"7d":12,"A":[0,3,7,12],"AT":10,"After":[2,4,12],"All":[3,8,12],"An":[0,12],"And":0,"As":[4,7],"By":[7,12],"Do":[0,12],"Each":[4,7,12],"For":[0,4,12],"From":[3,8,12],"Further":7,"Have":12,"Here":10,"How":[0,12],"I":12,"IF":12,"If":[0,3,4,6,7,8,12],"In":[0,2,3,7,8,12],"It":[0,2,4,7,10,12],"More":6,"Most":[7,12],"NOT":12,"No":[3,6,8],"Not":[0,12],"On":[3,4,6,7,8,12],"Or":[4,6,12],"So":12,"Some":[2,3,7,8],"That":[0,7,12],"The":[0,3,4,6,7,11,12],"Then":[2,3,4,6,8,12],"There":7,"These":[7,12],"This":[0,5,6,7,10,12],"To":[0,2,4,6,7,9,10,12],"Under":[4,7],"What":5,"When":[0,3,5,8,12],"Where":[3,8],"While":[7,12],"With":[0,7,12],"YOUR":4,"You":[2,7,12],"_":12,"__getstate__":0,"__init__":0,"__setstate__":0,"_attempt":0,"_cluster":12,"_input":0,"_ipdatabaserecord":0,"_serverless_rejected_set":0,"_sourc":4,"_task":4,"_update_by_queri":[0,4],"aadst":12,"abl":6,"abort":[4,12],"abov":[0,2,4,6,7,12],"absent":4,"accept":[0,3,4,7,8,12],"access":[0,4,5,12],"access_key_id":12,"access_token":0,"accessright":12,"accident":[3,8],"account":[6,7,12],"accumul":0,"acm":10,"acquir":12,"acquisit":12,"across":[0,7,12],"action":[3,8,12],"activ":[4,5,12],"active_primary_shard":12,"active_shard":12,"actual":[0,3,10],"ad":12,"add":[0,2,3,4,6,7,8,12],"addit":[3,8,12],"address":[0,2,3,4,6,7,8,10,12],"addresse":7,"adjust":4,"adkim":10,"admin":[3,8,12],"administr":[3,8,12],"advanc":7,"afterward":0,"agari":5,"age":12,"agent":4,"agg":7,"aggreg":[0,4,5,11,12],"aggregate_csv_filenam":[0,12],"aggregate_index":0,"aggregate_json_filenam":[0,12],"aggregate_report":[0,12],"aggregate_top":12,"aggregate_url":12,"aggregatealign":0,"aggregateauthresult":0,"aggregateauthresultdkim":0,"aggregateauthresultspf":0,"aggregateidentifi":0,"aggregateparsedreport":0,"aggregatepolicyevalu":0,"aggregatepolicyoverridereason":0,"aggregatepolicypublish":0,"aggregaterecord":0,"aggregatereport":0,"aggregatereportmetadata":0,"alia":[0,12],"alias":12,"align":[4,5,7,10],"aliv":0,"allow":[2,3,8,12],"allow_unencrypted_storag":12,"allowremot":2,"allowstringindic":7,"alon":12,"alreadi":[0,4,12],"alreadysav":0,"also":[0,2,3,4,6,7,8,12],"alter":[3,8],"altern":[5,12],"although":11,"alway":[0,2,4,12],"always_use_local_fil":[0,12],"amazon":5,"amd64":12,"amount":12,"analyt":[5,12],"analyz":12,"ani":[0,3,4,6,7,8,12],"anonym":10,"anoth":[6,12],"answer":[0,12],"apach":5,"api":[2,4,5,12],"api_key":[0,12],"app":12,"appear":[4,7,12],"append":[0,12],"append_json":0,"appendix":10,"appid":12,"appli":[0,12],"applic":[4,12],"applicationaccesspolici":12,"approach":12,"approxim":2,"apt":[2,4,6],"archiv":0,"archive_directori":12,"archive_fold":[0,12],"argument":[0,12],"arm64":12,"around":12,"array":[0,4],"arraylist":4,"arriv":12,"arrival_d":10,"arrival_date_utc":[0,10],"artifact":4,"as_domain":[0,10],"as_nam":[0,10],"asid":12,"ask":3,"asmx":2,"asn":[0,6,10,12],"aspf":10,"assembl":0,"assert":12,"assign":4,"associ":0,"assum":12,"assume_utc":0,"astimezon":0,"att":10,"attach":[0,3,8,10,12],"attachment_filenam":0,"attempt":[0,12],"attribut":[6,7],"audit":4,"auth":[0,2,4,7,10,12],"auth_failur":10,"auth_method":12,"auth_mod":12,"auth_result":10,"auth_typ":[0,12],"authent":[0,2,3,4,7,12],"authentication_mechan":10,"authentication_result":10,"authentication_typ":12,"auto":2,"automat":[4,6,12],"avail":[0,6,12],"avoid":[7,12],"aw":[0,12],"aws_region":[0,12],"aws_servic":[0,12],"awssigv4":[0,12],"az":12,"azur":[5,12],"b":10,"b2c":7,"back":[0,12],"backend":[0,12],"backfil":[0,5,12],"background":[0,4],"backlog":12,"backward":[0,12],"bare":12,"base":[0,2,3,4,6,7,8,10,12],"base64":0,"base_domain":[0,10],"basic":[0,2,12],"batch":[0,12],"batch_siz":[0,12],"bcc":[0,10],"bd6e1bb5":10,"becaus":[2,3,4,7,8,12],"becom":12,"befor":[0,12],"begin":12,"begin_d":10,"behavior":[0,12],"behind":6,"benefit":[0,5],"best":[7,12],"beyond":0,"bin":[2,4,6,12],"binari":[0,12],"binaryio":0,"bind":[0,2],"bindaddress":2,"blank":[3,8],"block":[0,2,4,12],"bodi":[0,3,8,10,12],"bookkeep":0,"bool":[0,4,12],"bound":12,"boundari":[0,12],"box":12,"brand":[0,5,7],"break":[3,4,8],"briefli":12,"broken":[0,12],"broker":12,"browser":4,"bucket":12,"budget":0,"bug":[5,12],"build":6,"built":[0,12],"bundl":[0,6,7,12],"busi":7,"button":[3,8],"byte":0,"c":[10,12],"ca":[4,12],"cach":[0,12],"cafile_path":12,"call":[0,5,12],"callabl":0,"callback":0,"caller":0,"came":[3,8],"can":[0,2,3,4,5,6,7,8,12],"cap":[0,12],"captur":0,"carri":[0,4,6,7,12],"case":[2,3,8,12],"catch":[0,12],"caught":0,"caus":[3,4,7,8,12],"cc":[0,10],"center":7,"cento":[4,6],"central":0,"cert":[4,12],"cert_path":12,"certain":[0,12],"certfile_path":12,"certif":[0,4,7,12],"certificate_password":12,"certificate_path":12,"cest":10,"cfg":0,"chain":0,"chang":[4,7,11,12],"charact":[2,12],"charset":10,"chart":7,"cheap":[0,4],"check":[0,2,3,4,7,12],"check_timeout":[0,12],"checkbox":4,"checkdmarc":3,"china":12,"chinacloudapi":12,"chines":7,"chmod":[2,4,12],"choos":[3,8],"chown":[2,12],"ci":7,"circular":0,"cisco":12,"class":[0,4],"classifi":0,"clean":[0,12],"clear":0,"cli":[0,5],"click":[4,7],"client":[2,3,4,8,12],"client_assert":12,"client_id":12,"client_secret":12,"clientassert":12,"clientsecret":12,"clientsotimeout":2,"clock":0,"close":[0,12],"cloud":[0,12],"cloudflar":[0,12],"cluster":[0,4,12],"cn":12,"co":4,"code":[0,4,12],"collect":[7,12],"collector":[11,12],"column":7,"com":[1,2,3,8,9,10,12],"combin":[0,5,7,12],"come":[0,7,12],"comfort":12,"comma":[6,12],"command":[0,2,3,4,6,8,12],"comment":12,"commerci":[4,5],"commit":0,"common":[3,4,6,8],"communiti":[3,8],"compat":[0,7,12],"complet":[0,3,4,12],"compli":[3,4,6,8,9],"complianc":7,"compliant":[3,8],"compon":[6,7],"compress":5,"comput":7,"condit":7,"conf":6,"config":[2,5,6],"config_fil":12,"config_reload":0,"configur":[0,3,4,5,6,7,8,9],"configure_ipinfo_api":0,"confirm":12,"conflict":4,"conform":4,"connect":[0,2,4,12],"connection_str":12,"consent":12,"consid":[5,7],"consist":[0,5,10],"consol":[4,12],"constant":0,"construct":[0,12],"consult":6,"consum":[7,12],"contact":[7,12],"contain":[0,7,11,12],"content":[0,3,4,8,10,11,12],"continu":4,"contrib":6,"contribut":5,"control":[0,4,12],"convent":12,"convert":[0,3,8],"convert_outlook_msg":0,"copi":[0,6,11,12],"core":[3,8],"correct":[0,6,7,12],"correspond":[4,12],"corrupt":0,"count":[0,2,4,7,10,12],"counter":0,"countri":[0,7,10,12],"country_cod":0,"cover":12,"cpan":6,"cr":12,"crash":[2,4,12],"creat":[0,2,3,4,6,8,12],"create_fold":0,"create_index":0,"creation":12,"creativ":6,"credenti":[4,6,12],"credentials_fil":12,"cron":[6,12],"cross":0,"crt":4,"csr":4,"csv":[0,5,12],"csvs":12,"ctrl":12,"ctx":4,"cumul":6,"curl":4,"current":[0,2,4,12],"custom":[4,7,12],"d":[0,4,12],"daemon":[2,4,12],"daili":[0,12],"dashboard":[4,5,9,11],"dat":0,"data":[0,4,5,6,7,9,11,12],"databas":[0,12],"dataclass":0,"date":[0,3,8,10,12],"date_utc":10,"datetim":0,"davmail":5,"day":[0,4,9,12],"db_path":0,"dbip":[0,6,12],"dbname":12,"dce":12,"dcr":12,"dcr_aggregate_stream":12,"dcr_failure_stream":12,"dcr_immutable_id":12,"dcr_smtp_tls_stream":12,"dd":[0,12],"de":[0,10],"dearmor":4,"deb":4,"debian":[4,5,6],"debug":[0,12],"decemb":6,"decod":0,"decode_base64":0,"dedic":6,"dedup":0,"dedupl":[0,12],"deeper":4,"def":4,"default":[0,2,4,5,6,7,12],"default_factori":0,"defeat":0,"defect":4,"defens":[4,5],"defin":0,"delay":[0,2,10,12],"deleg":12,"delegated_us":12,"delet":[0,2,4,12],"delete_aggreg":[0,12],"delete_failur":[0,12],"delete_invalid":[0,12],"delete_smtp_tl":[0,12],"deliber":[0,12],"deliveri":[0,12],"delivery_result":10,"demystifi":3,"deni":12,"depend":[0,4,5,12],"deploy":[3,8,12],"deprec":[7,12],"depth":4,"deriv":0,"describ":12,"descript":[2,6,12],"design":12,"destin":[0,12],"det":4,"detail":[0,4,6,7,12],"detect":12,"determin":12,"dev":[6,12],"devel":6,"develop":5,"devicecod":12,"dict":0,"dictionari":0,"didn":12,"differ":[7,12],"difficult":12,"dig":0,"digest":[3,8],"dir":6,"direct":[7,12],"directori":[0,6,12],"dis":10,"disabl":[0,2,6,12],"disclaim":[3,8],"disk":[0,12],"display":[3,7,11],"display_nam":10,"disposit":[0,7,10],"distinguish":12,"distribut":6,"distro":6,"dk":4,"dkim":[0,5,7,8,10],"dkim_align":10,"dkim_domain":10,"dkim_result":[4,10],"dkim_results_combin":[0,4],"dkim_selector":10,"dkm":3,"dmarc":[0,4,6,8,9,10,11,12],"dmarc_aggreg":[4,7],"dmarc_align":10,"dmarc_failur":4,"dmarc_moderation_act":[3,8],"dmarc_none_moderation_act":[3,8],"dmarc_quarantine_moderation_act":[3,8],"dmarcian":5,"dmarcresport":12,"dnf":6,"dns":[0,3,6,7,12],"dns_retri":[0,12],"dns_test_address":12,"dns_timeout":[0,12],"dnspython":0,"doc":[0,9,12],"doctyp":10,"document":[0,2,4,7,12],"dod":12,"doe":[0,3,8,12],"doesn":[0,12],"dom":4,"domain":[0,4,7,8,10,12],"domainawar":[1,3,12],"don":3,"doubl":12,"download":[0,2,4,6,12],"downloaderror":0,"dr":4,"draft":[5,10,12],"drop":0,"dropdown":7,"dsn":12,"dtd":10,"dummi":12,"duplic":0,"dure":[2,12],"e":[0,2,3,4,6,8,12],"e7":10,"earlier":[0,7],"easi":[4,9],"easier":[11,12],"echo":4,"edit":[2,6,7,12],"editor":11,"effect":12,"effici":4,"either":[0,4,5,12],"elast":[4,5,7,12],"elasticsearch":[0,5,12],"elasticsearcherror":0,"elig":12,"elk":12,"els":[4,12],"email":[0,3,5,6,7,8,10,11,12],"email_result":0,"email_results_via_msgraph":0,"emailaddress":0,"emailattach":0,"emailparsererror":0,"empti":[0,3,4,8,12],"en":[3,4,8,10],"enabl":[2,4,7,12],"enableew":2,"enablekeepal":2,"enableproxi":2,"encod":[0,10,12],"encount":0,"encrypt":[4,12],"encryptedsavedobject":4,"encryptionkey":4,"end":[0,3,4,5,12],"end_dat":10,"endpoint":[5,12],"endpoint_url":12,"enforc":[3,8],"enough":12,"enrich":[0,6,12],"enrol":4,"ensur":[3,4,6,8],"enterpris":12,"entir":[0,3,7,8,12],"entra":12,"entri":[0,12],"envelop":3,"envelope_from":10,"envelope_to":10,"environ":[5,6],"eof":0,"eol":5,"epel":6,"equal":0,"equival":4,"era":0,"error":[0,4,7,10,12],"erroritemnotfound":12,"es":[0,12],"escap":12,"especi":[7,12],"etc":[0,2,3,4,6,8,12],"even":[2,3,8,12],"event":[2,11,12],"everi":[0,2,4,6,7,12],"everyth":12,"ew":5,"ex":12,"exact":[0,3,8,12],"exampl":[3,4,6,8,10],"exceed":[0,7],"except":[0,12],"exchang":[2,10,12],"exclud":[2,12],"execreload":12,"execstart":[2,12],"exercis":0,"exhaust":12,"exist":[0,3,4,8,12],"exit":[0,12],"expect":12,"expens":0,"expir":12,"expiri":7,"expiringdict":0,"explain":[3,8],"explicit":[0,3,6,8,12],"export":[0,4,7,12],"extens":12,"extra":12,"extract":[0,2],"extract_report":0,"extract_report_from_file_path":0,"eye":[2,12],"f":[0,4],"factor":2,"factori":0,"fail":[0,3,7,8,10,12],"fail_on_output_error":12,"failed_sess":7,"failed_session_count":10,"failov":0,"failur":[0,5,11,12],"failure_csv_filenam":[0,12],"failure_detail":[4,10],"failure_details_combin":[0,4],"failure_index":0,"failure_json_filenam":[0,12],"failure_report":0,"failure_top":12,"failure_url":12,"failureparsedreport":0,"failurereport":0,"fall":[0,12],"fallback":[0,12],"fals":[0,2,4,10,12],"fantast":[3,8],"fast":0,"faster":12,"fatal":[0,12],"favor":[0,12],"fds":4,"featur":[4,12],"feedback":0,"feedback_report":0,"feedback_typ":10,"fetch":[0,7,12],"field":[0,5,7],"file":[0,2,5,6,7,11],"file_path":[0,12],"filenam":[0,12],"filename_safe_subject":10,"filepath":12,"fill":[4,6],"filter":[0,3,7,8,11,12],"final":5,"financ":12,"find":[3,7,8,12],"fine":[3,8],"finish":12,"first":[0,3,6,7,8,12],"first_strip_reply_to":[3,8],"fit":[3,8,12],"fix":[0,4,12],"flag":[0,2,6,12],"flat":0,"flexibl":11,"flight":12,"float":[0,12],"flush":12,"fo":[0,10],"fold":0,"folder":[0,2,12],"foldersizelimit":2,"follow":[2,4,5,12],"footer":[3,8],"forc":12,"foreground":12,"forens":[5,7,12],"forensicparsedreport":0,"forensicreport":0,"forev":12,"form":12,"format":[0,7,12],"former":[5,7,12],"forward":[3,7,8],"found":[0,4,6,12],"foundat":10,"four":12,"fqdn":4,"fraud":5,"free":[6,12],"fresh":[0,4,12],"freshest":12,"friend":7,"from_is_list":[3,8],"frozen":0,"ftp_proxi":6,"full":[0,12],"fulli":[0,3,4,7,8,12],"function":[0,12],"functool":0,"g":[0,2,3,4,6,8,12],"gateway":2,"gb":4,"gcc":[6,12],"gdpr":[4,9],"gelf":[5,12],"general":[3,6,8,12],"generat":[3,4,8,10],"geoip":[0,6,12],"geoipupd":6,"geolite2":5,"geoloc":[0,12],"get":[0,2,4,6,12],"get_base_domain":0,"get_dmarc_reports_from_mailbox":[0,12],"get_dmarc_reports_from_mbox":[0,12],"get_filename_safe_str":0,"get_ip_address_countri":0,"get_ip_address_db_record":0,"get_ip_address_info":0,"get_report_zip":0,"get_reverse_dn":0,"get_service_from_reverse_dns_base_domain":0,"ghcr":12,"github":[0,1,6,10,12],"give":[0,4],"given":[0,12],"glass":7,"glob":12,"global":12,"gmail":[0,5,7,12],"gmail_api":12,"go":[0,3,8],"goe":[3,8],"googl":[7,12],"googleapi":12,"got":12,"gov":12,"govern":12,"gpg":4,"grafana":5,"grant":12,"graph":[0,2,5,7,12],"graph_url":12,"graylog":5,"group":[2,7,12],"guard":0,"guid":[4,5],"guidanc":12,"gz":12,"gzip":[0,5],"h":[0,4,12],"hamburg":4,"hand":[3,8],"handl":[0,5,12],"handler":[7,12],"happen":[0,4,12],"hard":12,"has_defect":10,"hasn":12,"head":10,"header":[0,3,7,8,10,12],"header_from":10,"headless":2,"health":12,"healthcar":12,"heap":4,"heavi":4,"hec":[0,11,12],"hecclient":0,"hectokengoesher":12,"held":[0,12],"help":5,"hh":0,"hierarchi":12,"high":[7,12],"higher":[3,8],"histor":[4,12],"histori":12,"hit":[0,12],"hold":[0,12],"home":6,"hop":10,"host":[0,2,3,4,5,8,12],"hostnam":[0,12],"hour":[0,12],"hover":7,"href":10,"html":[3,4,8,10],"http":[0,2,4,5,6,10,11,12],"http_proxi":6,"https":[0,1,2,3,4,6,8,9,12],"https_proxi":6,"httpx":12,"human":[0,7],"human_timestamp":0,"human_timestamp_to_datetim":0,"human_timestamp_to_unix_timestamp":0,"hup":12,"icon":7,"id":[0,3,4,8,10,12],"ideal":[3,8],"idempot":[4,12],"ident":[0,3,4,8,12],"identifi":10,"idl":[0,2,12],"ignor":[0,12],"imag":12,"imap":[0,2,5,12],"imap_password":12,"imapalwaysapproxmsgs":2,"imapautoexpung":2,"imapcli":5,"imapconnect":12,"imapidledelay":2,"imapport":2,"immedi":[2,12],"immut":12,"impli":12,"import":[0,4,7,12],"improv":12,"inbox":[0,3,5,8,12],"inc":10,"includ":[0,3,4,6,7,8,12],"include_list_post_head":[3,8],"include_rfc2369_head":[3,8],"include_sender_head":[3,8],"include_spam_trash":12,"incom":[7,12],"incorrect":12,"increas":[4,12],"increment":12,"indefinit":12,"indent":12,"independ":0,"index":[0,5,7,9,11,12],"index_prefix":[0,4,12],"index_prefix_domain_map":12,"index_suffix":[0,4,12],"indic":[3,5],"individu":[0,7,12],"industri":12,"info":[0,12],"inform":[0,4,7,12],"infrequ":12,"ingest":12,"inherit":[0,12],"ini":[2,12],"init":0,"initi":[0,12],"inner":12,"input":[0,12],"input_":0,"insid":[4,12],"inspect":[0,12],"instal":[0,2,5,12],"installed_app":12,"instanc":[0,12],"instanceof":4,"instead":[0,3,4,6,8,12],"instruct":4,"int":[0,12],"intend":[3,8],"intent":0,"interact":[2,4,12],"interakt":10,"interfer":[3,8],"interleav":0,"interpret":[0,6],"interrupt":12,"interval":12,"interval_begin":10,"interval_end":10,"invalid":[0,12],"invalidaggregatereport":0,"invaliddmarcreport":0,"invalidfailurereport":0,"invalidforensicreport":0,"invalidipinfoapikey":0,"invalidsmtptlsreport":0,"invis":4,"invok":0,"involv":7,"io":[0,12],"ip":[0,3,4,7,12],"ip_address":[0,10],"ip_address_cach":0,"ip_db_path":[0,6,12],"ip_db_url":12,"ipaddressinfo":0,"ipinfo":[0,6,12],"ipinfo_api_token":12,"ipinfo_url":12,"ipsourceinfo":0,"ipv4":0,"ipv6":0,"is_mbox":0,"is_outlook_msg":0,"iso":[0,12],"isol":[0,12],"issu":[0,1,12],"item":[0,12],"java":2,"job":[3,6,8],"joe":[3,8],"journalctl":[2,12],"jre":2,"json":[0,4,5,12],"june":5,"junk":12,"just":[4,7,12],"jvm":4,"jwt":12,"kafka":[5,12],"kb4099855":6,"kb4134118":6,"kb4295699":6,"keep":[0,4,7,12],"keep_al":[0,12],"keepal":2,"kept":0,"key":[0,3,4,6,12],"keyfile_path":12,"keyout":4,"keyr":4,"keystor":4,"keyword":[0,12],"kibana":[5,11],"kill":12,"killsign":12,"kind":12,"know":3,"known":[0,3,7,8,12],"kubernet":12,"kwarg":0,"l4":12,"l5":12,"label":12,"lack":4,"lang":4,"languag":[3,8],"larg":[2,12],"larger":12,"last":6,"later":[0,4,6,12],"latest":[2,4,9,12],"layer":0,"layout":11,"leak":7,"least":[4,6,12],"leav":[0,3],"left":[0,7,12],"legaci":[0,5],"legal":[3,8],"legitim":[7,12],"less":12,"let":0,"level":[0,3,4,12],"lf":12,"libemail":6,"libpq":12,"librari":5,"libxml2":6,"libxslt":6,"licens":6,"life":5,"lifetim":0,"lifetimetimeout":0,"like":[0,3,6,7,8,12],"limit":[0,2,12],"line":[3,8,12],"link":[3,4,7,8],"linux":[3,6,8],"list":[0,2,4,5,7,12],"listen":[2,12],"lite":[0,6,12],"live":[7,12],"ll":[3,8],"load":[0,4,12],"load_ip_db":0,"load_psl_overrid":0,"load_reverse_dns_map":0,"local":[0,2,4,6,10,12],"local_file_path":0,"local_psl_overrides_path":12,"local_reverse_dns_map_path":12,"localhost":[4,12],"locat":[0,7,12],"log":[0,2,4,5,12],"log_analyt":12,"log_fil":12,"logger":12,"login":[4,12],"logstash":4,"long":[0,3,12],"longer":[3,6,8],"look":[0,3,7],"lookup":[0,12],"loop":[0,12],"loopback":2,"lose":12,"loss":0,"lot":7,"low":12,"lower":12,"lua":10,"m":[0,6,12],"m365":12,"maco":6,"magnifi":7,"mail":[0,5,6,10,12],"mail_bcc":0,"mail_cc":0,"mail_from":0,"mail_to":0,"mailbox":[0,7],"mailbox_check_timeout":12,"mailbox_connect":0,"mailboxconnect":0,"maildir":[0,12],"maildir_cr":12,"maildir_path":12,"mailer":10,"mailrelay":10,"mailsuit":[0,12],"mailto":6,"main":[4,12],"mainpid":12,"maintain":5,"make":[0,3,4,6,8,9,12],"malici":[7,12],"manag":[4,7,12],"mandatori":12,"mani":[0,12],"manual":[0,4,12],"map":0,"mariadb":12,"market":7,"massiv":12,"match":[0,4,7,11,12],"max_ag":10,"max_shards_per_nod":12,"max_unsaved_retri":[0,12],"maximum":4,"maxmind":[0,5,12],"may":[0,5,7,12],"mbox":[0,12],"md":0,"mean":[0,12],"meantim":0,"mechan":3,"member":[3,8,12],"memori":[0,12],"mention":7,"menu":[4,7],"mere":0,"merg":0,"messag":[0,2,3,4,6,7,8,10],"message_id":10,"meta":10,"method":12,"metric":7,"mfrom":[4,10],"microsoft":[0,2,5,10,12],"microsoftgraph":12,"microsoftonlin":12,"mid":12,"might":[0,3,7,8],"migrat":[0,7,12],"migrate_index":0,"mime":10,"min":0,"mind":12,"minim":12,"minimum":[4,12],"minimum_should_match":4,"minut":[0,2,12],"mirror":0,"miss":[4,6,12],"mitig":[3,8],"mix":0,"mm":[0,12],"mmdb":[0,6,12],"mobil":[3,8],"mode":[0,2,4,6,10],"modern":[2,3,8],"modifi":[0,3,8,12],"modul":[0,5,6,12],"mon":10,"monitor":[3,12],"month":[0,12],"monthly_index":[0,12],"mous":7,"move":[0,4,12],"ms":[0,10,12],"msal":12,"msg":[0,6],"msg_byte":0,"msg_date":0,"msg_footer":[3,8],"msg_header":[3,8],"msgconvert":[0,6],"msgraph":12,"msgraphconnect":0,"mta":7,"much":12,"multi":[2,5],"multipl":[0,7,12],"multipli":12,"multiprocess":0,"mung":[3,8],"must":[0,2,3,4,8,12],"must_not":4,"mutat":0,"mutual":[4,12],"mv":4,"mx":[7,10],"n":[0,10,12],"n_proc":[0,12],"naiv":0,"name":[0,3,4,7,10,11],"nameserv":[0,12],"nano":[2,12],"nation":12,"navig":[3,8],"ncontent":10,"ndate":10,"ndjson":[4,7],"necessarili":7,"need":[0,2,3,4,6,7,8,12],"negat":[0,12],"neither":[0,12],"nelson":[3,8],"net":[2,12],"network":[0,2,4,12],"never":[0,4,12],"new":[0,2,4,5,6,7,12],"newer":6,"newest":[2,12],"newkey":4,"newli":0,"news":3,"next":[0,4,12],"nfrom":10,"nmessag":10,"nmime":10,"node":4,"nologin":6,"non":[0,3,4,8,12],"nonameserv":0,"none":[0,3,4,10,12],"noproxyfor":2,"norepli":[3,10],"normal":[0,10,12],"normalize_timespan_threshold_hour":0,"normalized_timespan":10,"nosecureimap":2,"notabl":7,"note":[0,12],"noth":[4,12],"notic":12,"now":[0,4,6,7,12],"nowher":12,"nsubject":10,"nto":10,"null":[4,6,10],"number":[0,7,12],"number_of_replica":[0,12],"number_of_shard":[0,12],"numer":12,"nwettbewerb":10,"nx":10,"o":[2,4,12],"oR":6,"oauth2":12,"oauth2_port":12,"object":[0,4,7,12],"observ":[7,12],"occur":[0,7],"occurr":11,"oct":10,"offic":2,"office365":2,"offici":12,"offlin":[0,6,12],"offset":[0,12],"often":[7,12],"old":[0,7],"older":[4,6,10,12],"oldest":[2,12],"ole":[0,6],"omit":[0,12],"onc":[0,4,7],"ondmarc":5,"one":[0,3,4,5,6,7,8,12],"onli":[0,2,3,4,6,7,8],"onlin":[0,2,12],"onto":0,"oor":0,"op":0,"open":[0,3],"opendn":12,"opensearch":[4,5,7,12],"opensearch_dashboard":7,"opensearcherror":0,"openssl":4,"oper":12,"opt":[2,6,12],"option":[0,2,3,4,5,8,11,12],"orchestr":[0,12],"order":12,"org":[0,6,9,10,12],"org_email":10,"org_extra_contact_info":10,"org_nam":10,"organiz":[2,5,7,12],"organization_nam":10,"origin":[3,8,12],"original_envelope_id":10,"original_mail_from":10,"original_rcpt_to":10,"original_timespan_second":10,"os":0,"oserror":0,"otherwis":[0,12],"outag":12,"outdat":7,"outgo":[3,8,12],"outlook":[0,2,6,12],"output":[0,5,12],"output_directori":0,"outsid":12,"overal":0,"overrid":[0,6,12],"overwrit":[0,4,12],"overwritten":12,"owa":[5,12],"owned":6,"ownership":6,"owns":[0,12],"p":[3,4,10],"p12":4,"pack":4,"packag":[0,4,6,12],"packet":0,"pad":[0,12],"page":[3,4,6,7,8],"paginate_messag":12,"painless":4,"pair":[4,7],"pan":10,"panel":7,"parallel":[0,12],"paramet":[0,12],"parent":7,"pars":[0,3,5,6,10,12],"parse_aggregate_report_fil":[0,12],"parse_aggregate_report_xml":[0,12],"parse_email":0,"parse_failure_report":[0,12],"parse_forensic_report":0,"parse_report_email":[0,12],"parse_report_fil":[0,12],"parse_smtp_tls_report_json":0,"parsed_aggregate_reports_to_csv":0,"parsed_aggregate_reports_to_csv_row":0,"parsed_failure_reports_to_csv":0,"parsed_failure_reports_to_csv_row":0,"parsed_forensic_reports_to_csv":0,"parsed_forensic_reports_to_csv_row":0,"parsed_sampl":10,"parsed_smtp_tls_reports_to_csv":0,"parsed_smtp_tls_reports_to_csv_row":0,"parsedemail":0,"parsedmarc":[4,9,10,11],"parsedmarc_":12,"parsedmarc_config_fil":12,"parsedmarc_debug":12,"parsedmarc_elasticsearch_":12,"parsedmarc_elasticsearch_host":12,"parsedmarc_elasticsearch_ssl":12,"parsedmarc_gelf_":12,"parsedmarc_general_":12,"parsedmarc_general_debug":12,"parsedmarc_general_ipinfo_api_token":12,"parsedmarc_general_ipinfo_url":12,"parsedmarc_general_offlin":12,"parsedmarc_general_save_aggreg":12,"parsedmarc_general_save_failur":12,"parsedmarc_gmail_api_":12,"parsedmarc_gmail_api_credentials_file_fil":12,"parsedmarc_imap_":12,"parsedmarc_imap_host":12,"parsedmarc_imap_password":12,"parsedmarc_imap_password_fil":12,"parsedmarc_imap_us":12,"parsedmarc_kafka_":12,"parsedmarc_log_analytics_":12,"parsedmarc_mailbox_":12,"parsedmarc_mailbox_watch":12,"parsedmarc_maildir_":12,"parsedmarc_msgraph_":12,"parsedmarc_opensearch_":12,"parsedmarc_s3_":12,"parsedmarc_smtp_":12,"parsedmarc_splunk_hec_":12,"parsedmarc_splunk_hec_index":12,"parsedmarc_splunk_hec_token":12,"parsedmarc_splunk_hec_url":12,"parsedmarc_syslog_":12,"parsedmarc_webhook_":12,"parser":0,"parserconfig":[0,12],"parsererror":0,"parsingresult":0,"part":[0,3,4,7,8,12],"partial":0,"particular":[7,12],"pass":[0,3,7,10,12],"passsword":12,"password":[0,4,6,12],"paste":[4,11],"patch":6,"path":[0,4,6,12],"pathlik":0,"pattern":[0,5,7,12],"pay":12,"payload":[0,12],"pct":10,"peak":12,"pem":12,"per":[0,4,7,12],"percentag":7,"perform":[2,5],"period":12,"perl":[0,6],"perman":12,"permiss":[4,12],"persist":[0,12],"peter":10,"phase":0,"pick":[6,12],"pickl":0,"pickup":6,"pid":12,"pie":7,"pin":12,"pip":[6,12],"pipelin":0,"pkcs12":12,"place":[0,4,7,12],"plain":[0,12],"plaintext":[3,8],"platform":[3,6,8,12],"pleas":[1,5,12],"plug":12,"plus":[0,7,12],"point":[4,6,12],"pol":4,"polici":[0,3,4,7,8,10,12],"policies_combin":[0,4],"policy_domain":[4,10],"policy_evalu":10,"policy_override_com":10,"policy_override_reason":10,"policy_publish":10,"policy_str":10,"policy_typ":[4,10],"policyscopegroupid":12,"poll":[0,2,12],"popul":0,"port":[0,2,12],"portal":12,"posit":[0,12],"posix":0,"possibl":12,"post":[3,4,8,12],"poster":[3,8],"postgr":12,"postgresql":[5,12],"postorius":[3,8],"powershel":12,"ppa":6,"pre":[0,6,12],"prebuilt":12,"predict":12,"prefer":[2,6,12],"prefix":[0,3,8,12],"premad":[5,11],"prepend":0,"prerequisit":5,"present":12,"preserv":0,"pressur":12,"pretti":12,"prettifi":12,"previous":[0,2,4,6,12],"pri":[2,12],"primari":0,"print":12,"printabl":10,"prior":0,"prioriti":12,"privaci":[3,6,7,8,12],"privat":12,"probe":0,"problem":12,"proc":12,"proceed":4,"process":[0,2,5,6,12],"produc":[0,10],"program":12,"programdata":6,"progress":[4,12],"project":[0,2,3,5,11,12],"prompt":4,"proofpoint":5,"propag":0,"properti":2,"protect":[2,3,5,8,12],"protocol":12,"provid":[0,4,7,12],"provis":12,"prox":6,"proxi":2,"proxyhost":2,"proxypassword":2,"proxyport":2,"proxyus":2,"ps":4,"psl":[0,12],"psl_overrid":0,"psl_overrides_path":0,"psl_overrides_url":[0,12],"psycopg":12,"public":[0,3,10,12],"public_suffix_list":0,"publicbaseurl":4,"publicsuffix":0,"publish":[3,12],"published_polici":0,"pull":12,"purpos":4,"put":[4,12],"py":0,"python":[0,4,6,12],"python3":6,"qo":4,"quarantin":[3,8],"queri":[0,4,12],"query_dn":0,"quick":0,"quickstart":12,"quit":12,"quot":[10,12],"quota":[0,12],"r":[2,10,12],"rais":[0,12],"ram":[4,12],"rate":[0,12],"rather":[0,3,4,7,8,12],"ratio":7,"raw":12,"re":[0,4,6,12],"reach":[0,12],"reachabl":12,"read":[0,12],"readabl":[0,12],"readwrit":12,"real":[0,7],"realli":3,"reason":[0,2,4,5,12],"rebind":0,"rebuilt":0,"receiv":[0,7,10,12],"receiveddatetim":12,"receiving_ip":[4,10],"receiving_mx_hostnam":[4,10],"recent":0,"recipi":7,"recogn":[7,12],"recommend":12,"recommended_dns_nameserv":0,"record":[0,5,6,10,12],"record_typ":0,"recov":[0,12],"recurs":12,"redact":12,"redi":12,"reduc":[6,12],"refactor":0,"refer":[4,5,7,12],"referenc":12,"refresh":[6,12],"refresh_interv":12,"refus":4,"regard":12,"regardless":[0,10,12],"region":[0,12],"region_nam":12,"regist":[6,12],"registr":12,"regul":[4,6,9,12],"regular":[3,8,12],"reject":[0,3,8,12],"relat":[3,12],"relay":[3,8],"releas":[0,4,6],"reli":[6,7],"reliabl":12,"reload":[0,2,4],"remain":[0,7,12],"remot":2,"remov":[0,3,4,8,12],"render":7,"repars":0,"repeat":[0,3,8,12],"replac":[0,3,4,8,12],"repli":[2,3,8],"replic":12,"replica":[0,12],"reply_goes_to_list":[3,8],"reply_to":10,"replyto":[3,8],"repopul":0,"report":[0,4,11],"report_id":10,"report_metadata":10,"report_typ":0,"reported_domain":10,"reports_fold":[0,12],"repositori":[6,11],"req":4,"request":[0,2,4,12],"requir":[0,2,3,4,5,6,7,8,12],"require_encrypt":0,"res":4,"reserv":12,"reset":0,"resid":12,"resolv":[0,12],"resort":6,"resourc":[0,4,5,12],"respect":7,"respons":[0,12],"rest":[0,12],"restart":[2,3,4,6,8],"restartsec":[2,12],"restor":4,"restrict":12,"restrictaccess":12,"restructur":7,"result":[0,5,7,10,12],"result_typ":[4,10],"resum":12,"retain":[3,8,12],"retent":[0,5],"retri":[0,4,12],"retriev":2,"retry_attempt":12,"retry_delay":12,"return":[0,4],"revers":[0,6,7,12],"reverse_dn":[0,10],"reverse_dns_base_domain":0,"reverse_dns_map":0,"reverse_dns_map_path":0,"reverse_dns_map_url":[0,12],"reversednsservic":0,"review":7,"rewrit":[0,3,8],"rfc":[0,3,5,8,10],"rfc2369":[3,8],"rfc822":2,"rhel":[4,5,6],"ri":4,"right":[4,7],"rm":4,"rmh":4,"rocki":6,"rollup":6,"root":[2,12],"rough":12,"row":7,"rpm":4,"rpt":[5,7],"rsa":4,"rt":4,"rua":[5,6],"ruf":[5,6,7,12],"rule":[7,12],"run":[0,4,5,6],"runtimeerror":12,"rw":[2,12],"s":[0,2,3,4,6,7,8,10,12],"s3":[5,12],"safe":[0,4,12],"sampl":[0,5,7,12],"sample_headers_on":10,"satisfi":7,"save":[0,4,6,7],"save_aggreg":12,"save_aggregate_report_to_elasticsearch":0,"save_aggregate_report_to_opensearch":0,"save_aggregate_reports_to_splunk":0,"save_callback":0,"save_failur":12,"save_failure_report_to_elasticsearch":0,"save_failure_report_to_opensearch":0,"save_failure_reports_to_splunk":0,"save_forens":12,"save_forensic_report_to_elasticsearch":0,"save_forensic_report_to_opensearch":0,"save_forensic_reports_to_splunk":0,"save_output":0,"save_smtp_tl":12,"save_smtp_tls_report_to_elasticsearch":0,"save_smtp_tls_report_to_opensearch":0,"save_smtp_tls_reports_to_splunk":0,"say":[0,12],"sbin":6,"sc":4,"scalar":4,"schedul":[6,12],"schema":[5,10,12],"scheme":0,"scope":[4,7,10,12],"script":[4,6],"scrub_nondigest":[3,8],"sdk":12,"search":[0,3,4,8,12],"second":[0,2,12],"secret_access_key":12,"section":4,"secur":[0,4,12],"see":[0,2,3,4,6,7,12],"seek":0,"seen":[0,12],"seen_aggregate_report_id":0,"segment":7,"sel":4,"select":0,"selector":[4,7,10],"self":[4,5],"send":[0,2,3,4,5,7,8,11,12],"sender":[0,5,7,8],"sending_mta_ip":[4,10],"sendmail":[0,12],"sensit":12,"sent":[0,3,8,12],"sentinel":5,"separ":[0,3,4,6,7,9,11,12],"sequenc":0,"sequenti":[0,12],"serial":[0,12],"server":[0,2,3,4,5,6,7,10,12],"server_ip":4,"serverless":[0,12],"servernameon":10,"servic":[0,3,4,5,6,7,8,10],"service_account":12,"service_account_us":12,"session":[0,7],"set":[0,2,3,4,6,7,8,9,12],"set_host":0,"setup":[4,6,9,12],"shape":[0,4],"shard":[0,12],"share":[0,4,6,7,12],"sharealik":6,"sharepoint":10,"shell":6,"ship":[6,12],"short":12,"shot":[0,12],"shouldn":[3,8],"show":[2,7,12],"shown":[6,7,12],"shutdown":[0,12],"sibl":7,"side":[7,12],"sighup":[0,6,12],"sigkil":12,"sign":[0,3,4,6,12],"signal":12,"signatur":[3,7,8],"sigterm":[0,12],"sigv4":[0,12],"silent":[0,6,12],"similar":7,"simpl":5,"simpli":[0,12],"simplifi":0,"sinc":[0,6,7,12],"singl":[0,7,12],"sink":12,"sister":3,"six":12,"size":[2,4],"skel":6,"skip":[0,4,12],"skip_certificate_verif":[0,12],"slight":11,"slow":0,"small":[4,12],"smaller":12,"smi":4,"smtp":[0,3,4,5,12],"smtp_tls":[0,4,12],"smtp_tls_csv_filenam":[0,12],"smtp_tls_index":0,"smtp_tls_json_filenam":[0,12],"smtp_tls_report":0,"smtp_tls_url":12,"smtptlsfailuredetail":0,"smtptlsfailuredetailsopt":0,"smtptlsparsedreport":0,"smtptlspolici":0,"smtptlspolicysummari":0,"smtptlsreport":0,"socket":2,"solut":6,"somehow":12,"someon":4,"sometim":12,"sort":12,"sourc":[0,3,4,6,7,10],"source_as_domain":10,"source_as_nam":10,"source_asn":10,"source_base_domain":10,"source_countri":10,"source_ip_address":10,"source_nam":10,"source_reverse_dn":10,"source_typ":10,"sourceforg":2,"sovereign":12,"sp":[3,4,10],"spam":12,"spawn":0,"special":12,"specif":[0,3,6,7,12],"specifi":[2,3],"spf":[0,5,7,10],"spf_align":10,"spf_domain":10,"spf_result":[4,10],"spf_results_combin":[0,4],"spf_scope":10,"split":0,"splunk":[5,12],"splunk_hec":12,"splunkerror":0,"splunkhec":12,"sponsor":5,"spoof":[3,8],"spurious":12,"sr":4,"ss":0,"ssl":[0,2,4,12],"ssl_cert_path":0,"stabl":4,"stack":[4,7,12],"stale":0,"standard":[0,5,6,10],"start":[0,2,4,7,9,11,12],"starttl":[7,12],"startup":[0,4,6],"state":0,"static":12,"status":[2,12],"stay":[0,7,12],"stdout":12,"step":[3,4,6,8,12],"still":[0,3,4,8,10,12],"stop":12,"storag":[0,4,12],"store":[2,4,7,9,12],"str":[0,12],"straight":[0,12],"stream":12,"string":[0,4,7,12],"strip":[0,3,8,12],"strip_attachment_payload":[0,12],"strong":12,"structur":5,"sts":[7,10,12],"stsv1":10,"style":0,"subdomain":[0,3,12],"subfield":4,"subfold":[0,12],"subject":[0,3,8,10,12],"subject_prefix":[3,8],"submiss":0,"submit":[0,4],"subsidiari":7,"substitut":6,"success":[0,12],"successful_sess":7,"successful_session_count":10,"sudo":[2,4,6,12],"suffici":12,"suffix":0,"suggest":7,"suit":12,"suitabl":0,"sum":7,"summari":[3,8,12],"supervis":12,"suppli":[0,7,12],"support":[2,4,5,7,10,11],"sure":4,"surfac":[7,12],"sw50zxjha3rpdmugv2v0dgjld2vyymvylcocymvyc2ljahq":10,"swallow":12,"switch":7,"syslog":[2,5,12],"system":[2,3,4,6,8,12],"systemctl":[2,4,12],"systemd":5,"systemdr":6,"t":[0,4,5,7,8,10,12],"tab":[3,4,8],"tabl":[4,5,7,12],"tag":6,"take":[0,12],"talk":[0,4],"target":[0,2,12],"task":[0,4,6],"tbi":10,"tcp":12,"tee":4,"tell":[0,3,7,8],"templat":[3,8],"temporari":7,"tenant":5,"tenant_id":12,"term":6,"test":[0,10,12],"text":[0,4,10],"thank":10,"therebi":[3,8],"therefor":12,"thing":12,"third":0,"though":7,"thousand":12,"three":[0,7,12],"throughput":12,"tier":12,"time":[0,2,4,6,7,12],"timeout":[0,2,12],"timeoutstopsec":12,"timer":12,"timespan":0,"timespan_requires_norm":10,"timestamp":[0,12],"timestamp_to_datetim":0,"timestamp_to_human":0,"timezon":10,"tld":3,"tls":[0,4,5,12],"to_domain":10,"to_utc":0,"togeth":[7,12],"token":[0,4,12],"token_fil":12,"tool":12,"top":[3,7,12],"topic":12,"total":7,"touch":[0,3,8],"toward":0,"tracker":1,"trade":12,"tradit":[3,8],"traffic":7,"trail":12,"transfer":10,"transient":[0,12],"transpar":5,"transport":[4,12],"trash":12,"treat":[0,12],"treatment":0,"tri":[0,12],"troubleshoot":12,"true":[0,2,4,10,12],"trust":12,"truststor":4,"truth":7,"tsvb":7,"tuesday":6,"tune":5,"two":[0,6,7,12],"txt":[0,12],"typ":4,"type":[4,5,7,10,12],"typic":12,"typo":12,"u":[2,6,12],"ubuntu":[4,6],"udp":[0,12],"ui":[3,8],"unaffect":12,"unavail":12,"unchang":[0,12],"uncondit":[3,8,12],"underlying":[0,12],"underneath":7,"underscor":12,"understand":[5,7],"unencrypt":12,"unexpir":12,"unfortun":[3,8],"unit":[0,2,12],"unix":0,"unknown":0,"unless":[6,12],"unpars":[0,12],"unpickl":0,"unreach":12,"unread":12,"unrel":6,"unsav":[0,12],"unsubscrib":[3,8],"unsuit":12,"unus":0,"unzip":2,"updat":[0,4,6,12],"update_by_queri":0,"upersecur":12,"upgrad":[2,5,6,12],"upload":12,"upper":7,"uppercas":12,"uri":[6,12],"url":[0,2,4,12],"us":[10,12],"usabl":12,"usag":12,"use":[0,3,4,5,8,10],"use_ssl":0,"user":[0,2,3,4,6,7,8,10,12],"user_ag":10,"useradd":[2,6],"usernam":[0,12],"usernamepassword":12,"usesystemproxi":2,"usr":[4,6],"usual":12,"utc":[0,12],"utf":10,"util":5,"v":12,"v2":0,"valid":[0,7,10,12],"valimail":5,"valu":[0,3,4,7,8,12],"valueerror":0,"var":[3,8,12],"variabl":5,"variant":[0,12],"various":6,"vendor":3,"venv":[6,12],"verbatim":12,"verbos":12,"veri":[0,4,7,12],"verif":[0,4,12],"verifi":0,"verification_mod":4,"version":[0,2,4,5,9,10,11,12],"vew":2,"via":[0,2],"view":[7,12],"vim":4,"virtualenv":6,"visual":[4,7,9],"volum":[7,12],"vulner":3,"w":[0,12],"w3c":10,"wait":[0,12],"wait_for_complet":[0,4],"wall":0,"want":[2,12],"wantedbi":[2,12],"warm":0,"warn":[0,4,12],"watch":[0,2,4,6,12],"watch_inbox":[0,12],"watcher":[0,12],"way":[0,4,7,12],"web":[2,4],"webdav":2,"webhook":[5,12],"webmail":[3,7,8],"week":[0,6,12],"well":[2,7,12],"wettbewerb":10,"wget":4,"whalensolut":12,"whatev":[0,12],"wheel":12,"whenev":[0,2,12],"wherea":7,"wherev":12,"whether":[0,12],"whi":[3,7,12],"whole":[0,7,12],"whose":[0,12],"wide":[6,10,12],"wider":12,"wiki":10,"will":[0,2,3,4,6,7,8,12],"win":12,"window":[6,12],"within":[0,12],"without":[3,4,6,7,8],"won":5,"work":[2,3,4,5,6,7,8,12],"worker":[0,12],"workstat":2,"worst":[3,12],"worth":12,"wrap":[3,8],"wrapper":12,"write":[0,4,12],"written":12,"www":[4,6,12],"x":[4,7,10],"x509":4,"xennn":10,"xml":[0,11,12],"xml_schema":10,"xms4g":4,"xmx4g":4,"xpack":4,"xxxx":4,"y":[4,6],"yahoo":7,"yaml":12,"year":12,"yes":[3,8],"yet":[0,3,4,12],"yml":4,"yyyi":[0,12],"z":12,"zero":12,"zip":[0,2,5,12],"\u00fcbersicht":10},"titles":["API reference","Contributing to parsedmarc","Accessing an inbox using OWA/EWS","Understanding DMARC","Elasticsearch and Kibana","parsedmarc documentation - Open source DMARC report analyzer and visualizer","Installation","Using the Kibana dashboards","What about mailing lists?","OpenSearch and Grafana","Sample outputs","Splunk","Using parsedmarc"],"titleterms":{"Do":[3,8],"What":[3,8],"_file":12,"access":2,"aggreg":[7,10],"align":3,"analyz":[5,6],"api":0,"archiv":12,"backfil":4,"best":[3,8],"bug":1,"cli":12,"combin":4,"compat":5,"compos":12,"config":[0,12],"configur":[2,12],"content":5,"contribut":1,"countri":6,"csv":10,"dashboard":7,"databas":6,"davmail":2,"depend":6,"dkim":[3,4],"dmarc":[3,5,7],"docker":12,"document":5,"domain":3,"elast":0,"elasticsearch":4,"env":12,"environ":12,"ew":2,"exampl":12,"exchang":6,"failur":[7,10],"featur":5,"field":4,"file":12,"geolite2":6,"grafana":9,"guid":3,"help":12,"inbox":2,"index":4,"indic":0,"instal":[4,6,9],"ip":6,"json":10,"kibana":[4,7],"librari":12,"list":[3,8],"listserv":[3,8],"lookalik":3,"mail":[3,8],"mailbox":12,"mailman":[3,8],"map":12,"maxmind":6,"messag":12,"microsoft":6,"mode":12,"multi":12,"multipl":6,"name":12,"onc":12,"onli":12,"open":5,"opensearch":[0,9],"option":6,"output":10,"owa":2,"parsedmarc":[0,1,2,5,6,12],"pattern":4,"perform":12,"practic":[3,8],"prerequisit":6,"proxi":6,"python":5,"record":[3,4,9],"refer":0,"reload":12,"report":[1,5,6,7,10,12],"resourc":3,"restart":12,"result":4,"retent":[4,9],"run":[2,12],"sampl":10,"save":12,"secret":12,"section":12,"sender":3,"servic":[2,12],"smtp":[7,10],"sourc":5,"specifi":12,"spf":[3,4],"splunk":[0,11],"suffix":12,"support":[3,12],"systemd":[2,12],"t":3,"tabl":0,"tenant":12,"test":6,"tls":[7,10],"tune":12,"type":0,"understand":3,"upgrad":4,"use":[2,6,7,12],"util":0,"valid":3,"variabl":12,"via":12,"visual":5,"web":6,"without":12,"won":3,"workaround":[3,8]}}) \ No newline at end of file +Search.setIndex({"alltitles":{"API reference":[[0,null]],"Accessing an inbox using OWA/EWS":[[2,null]],"Backfilling the combined DKIM/SPF result fields":[[4,"backfilling-the-combined-dkim-spf-result-fields"]],"Bug reports":[[1,"bug-reports"]],"CLI help":[[12,"cli-help"]],"CSV aggregate report":[[10,"csv-aggregate-report"]],"CSV failure report":[[10,"csv-failure-report"]],"Configuration file":[[12,"configuration-file"]],"Configuring parsedmarc for DavMail":[[2,"configuring-parsedmarc-for-davmail"]],"Contents":[[5,null]],"Contributing to parsedmarc":[[1,null]],"DMARC Alignment Guide":[[3,"dmarc-alignment-guide"]],"DMARC aggregate reports":[[7,"dmarc-aggregate-reports"]],"DMARC failure reports":[[7,"dmarc-failure-reports"]],"DMARC guides":[[3,"dmarc-guides"]],"Do":[[3,"do"],[8,"do"]],"Do not":[[3,"do-not"],[8,"do-not"]],"Docker Compose example":[[12,"docker-compose-example"]],"Docker secrets (_FILE suffix)":[[12,"docker-secrets-file-suffix"]],"Elasticsearch and Kibana":[[4,null]],"Environment variable configuration":[[12,"environment-variable-configuration"]],"Examples":[[12,"examples"]],"Features":[[5,"features"]],"IP-to-country database":[[6,"ip-to-country-database"]],"Indices and tables":[[0,"indices-and-tables"]],"Installation":[[4,"installation"],[6,null],[9,"installation"]],"Installing parsedmarc":[[6,"installing-parsedmarc"]],"JSON SMTP TLS report":[[10,"json-smtp-tls-report"]],"JSON aggregate report":[[10,"json-aggregate-report"]],"JSON failure report":[[10,"json-failure-report"]],"LISTSERV":[[3,"listserv"],[8,"listserv"]],"Lookalike domains":[[3,"lookalike-domains"]],"Mailbox messages are only archived once the reports are saved":[[12,"mailbox-messages-are-only-archived-once-the-reports-are-saved"]],"Mailing list best practices":[[3,"mailing-list-best-practices"],[8,"mailing-list-best-practices"]],"Mailman 2":[[3,"mailman-2"],[3,"id1"],[8,"mailman-2"],[8,"id1"]],"Mailman 3":[[3,"mailman-3"],[3,"id2"],[8,"mailman-3"],[8,"id2"]],"Multi-tenant support":[[12,"multi-tenant-support"]],"OpenSearch and Grafana":[[9,null]],"Optional dependencies":[[6,"optional-dependencies"]],"Performance tuning":[[12,"performance-tuning"]],"Prerequisites":[[6,"prerequisites"]],"Python Compatibility":[[5,"python-compatibility"]],"Records retention":[[4,"records-retention"],[9,"records-retention"]],"Reloading configuration without restarting":[[12,"reloading-configuration-without-restarting"]],"Resources":[[3,"resources"]],"Running DavMail as a systemd service":[[2,"running-davmail-as-a-systemd-service"]],"Running parsedmarc as a systemd service":[[12,"running-parsedmarc-as-a-systemd-service"]],"Running without a config file (env-only mode)":[[12,"running-without-a-config-file-env-only-mode"]],"SMTP TLS reporting":[[7,"smtp-tls-reporting"]],"SPF and DMARC record validation":[[3,"spf-and-dmarc-record-validation"]],"Sample aggregate report output":[[10,"sample-aggregate-report-output"]],"Sample failure report output":[[10,"sample-failure-report-output"]],"Sample outputs":[[10,null]],"Section name mapping":[[12,"section-name-mapping"]],"Specifying the config file via environment variable":[[12,"specifying-the-config-file-via-environment-variable"]],"Splunk":[[11,null]],"Testing multiple report analyzers":[[6,"testing-multiple-report-analyzers"]],"Understanding DMARC":[[3,null]],"Upgrading Kibana index patterns":[[4,"upgrading-kibana-index-patterns"]],"Using MaxMind GeoLite2 (optional)":[[6,"using-maxmind-geolite2-optional"]],"Using Microsoft Exchange":[[6,"using-microsoft-exchange"]],"Using a web proxy":[[6,"using-a-web-proxy"]],"Using parsedmarc":[[12,null]],"Using parsedmarc as a library":[[12,"using-parsedmarc-as-a-library"]],"Using the Kibana dashboards":[[7,null]],"What about mailing lists?":[[3,"what-about-mailing-lists"],[8,null]],"What if a sender won\u2019t support DKIM/DMARC?":[[3,"what-if-a-sender-wont-support-dkim-dmarc"]],"Workarounds":[[3,"workarounds"],[8,"workarounds"]],"parsedmarc":[[0,"module-parsedmarc"]],"parsedmarc documentation - Open source DMARC report analyzer and visualizer":[[5,null]],"parsedmarc.config":[[0,"module-parsedmarc.config"]],"parsedmarc.elastic":[[0,"module-parsedmarc.elastic"]],"parsedmarc.opensearch":[[0,"module-parsedmarc.opensearch"]],"parsedmarc.splunk":[[0,"module-parsedmarc.splunk"]],"parsedmarc.types":[[0,"module-parsedmarc.types"]],"parsedmarc.utils":[[0,"module-parsedmarc.utils"]]},"docnames":["api","contributing","davmail","dmarc","elasticsearch","index","installation","kibana","mailing-lists","opensearch","output","splunk","usage"],"envversion":{"sphinx":66,"sphinx.domains.c":3,"sphinx.domains.changeset":1,"sphinx.domains.citation":1,"sphinx.domains.cpp":9,"sphinx.domains.index":1,"sphinx.domains.javascript":3,"sphinx.domains.math":2,"sphinx.domains.python":4,"sphinx.domains.rst":2,"sphinx.domains.std":2,"sphinx.ext.todo":2,"sphinx.ext.viewcode":1},"filenames":["api.md","contributing.md","davmail.md","dmarc.md","elasticsearch.md","index.md","installation.md","kibana.md","mailing-lists.md","opensearch.md","output.md","splunk.md","usage.md"],"indexentries":{"aggregatealignment (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAlignment",false]],"aggregateauthresultdkim (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResultDKIM",false]],"aggregateauthresults (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResults",false]],"aggregateauthresultspf (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResultSPF",false]],"aggregateidentifiers (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateIdentifiers",false]],"aggregateparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateParsedReport",false]],"aggregatepolicyevaluated (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyEvaluated",false]],"aggregatepolicyoverridereason (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyOverrideReason",false]],"aggregatepolicypublished (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyPublished",false]],"aggregaterecord (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateRecord",false]],"aggregatereport (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateReport",false]],"aggregatereportmetadata (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateReportMetadata",false]],"alreadysaved":[[0,"parsedmarc.elastic.AlreadySaved",false],[0,"parsedmarc.opensearch.AlreadySaved",false]],"always_use_local_files (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.always_use_local_files",false]],"append_json() (in module parsedmarc)":[[0,"parsedmarc.append_json",false]],"close() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.close",false]],"configure_ipinfo_api() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.configure_ipinfo_api",false]],"convert_outlook_msg() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.convert_outlook_msg",false]],"create_indexes() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.create_indexes",false]],"create_indexes() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.create_indexes",false]],"decode_base64() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.decode_base64",false]],"dns_retries (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.dns_retries",false]],"dns_timeout (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.dns_timeout",false]],"downloaderror":[[0,"parsedmarc.utils.DownloadError",false]],"elasticsearcherror":[[0,"parsedmarc.elastic.ElasticsearchError",false]],"email_results() (in module parsedmarc)":[[0,"parsedmarc.email_results",false]],"email_results_via_msgraph() (in module parsedmarc)":[[0,"parsedmarc.email_results_via_msgraph",false]],"emailaddress (class in parsedmarc.types)":[[0,"parsedmarc.types.EmailAddress",false]],"emailattachment (class in parsedmarc.types)":[[0,"parsedmarc.types.EmailAttachment",false]],"emailparsererror":[[0,"parsedmarc.utils.EmailParserError",false]],"extract_report() (in module parsedmarc)":[[0,"parsedmarc.extract_report",false]],"extract_report_from_file_path() (in module parsedmarc)":[[0,"parsedmarc.extract_report_from_file_path",false]],"failureparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.FailureParsedReport",false]],"failurereport (class in parsedmarc.types)":[[0,"parsedmarc.types.FailureReport",false]],"forensicparsedreport (in module parsedmarc.types)":[[0,"parsedmarc.types.ForensicParsedReport",false]],"forensicreport (in module parsedmarc.types)":[[0,"parsedmarc.types.ForensicReport",false]],"get_base_domain() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_base_domain",false]],"get_dmarc_reports_from_mailbox() (in module parsedmarc)":[[0,"parsedmarc.get_dmarc_reports_from_mailbox",false]],"get_dmarc_reports_from_mbox() (in module parsedmarc)":[[0,"parsedmarc.get_dmarc_reports_from_mbox",false]],"get_filename_safe_string() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_filename_safe_string",false]],"get_ip_address_country() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_country",false]],"get_ip_address_db_record() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_db_record",false]],"get_ip_address_info() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_info",false]],"get_report_zip() (in module parsedmarc)":[[0,"parsedmarc.get_report_zip",false]],"get_reverse_dns() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_reverse_dns",false]],"get_service_from_reverse_dns_base_domain() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_service_from_reverse_dns_base_domain",false]],"hecclient (class in parsedmarc.splunk)":[[0,"parsedmarc.splunk.HECClient",false]],"human_timestamp_to_datetime() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.human_timestamp_to_datetime",false]],"human_timestamp_to_unix_timestamp() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.human_timestamp_to_unix_timestamp",false]],"invalidaggregatereport":[[0,"parsedmarc.InvalidAggregateReport",false]],"invaliddmarcreport":[[0,"parsedmarc.InvalidDMARCReport",false]],"invalidfailurereport":[[0,"parsedmarc.InvalidFailureReport",false]],"invalidforensicreport (in module parsedmarc)":[[0,"parsedmarc.InvalidForensicReport",false]],"invalidipinfoapikey":[[0,"parsedmarc.utils.InvalidIPinfoAPIKey",false]],"invalidsmtptlsreport":[[0,"parsedmarc.InvalidSMTPTLSReport",false]],"ip_address_cache (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.ip_address_cache",false]],"ip_db_path (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.ip_db_path",false]],"ipaddressinfo (class in parsedmarc.utils)":[[0,"parsedmarc.utils.IPAddressInfo",false]],"ipsourceinfo (class in parsedmarc.types)":[[0,"parsedmarc.types.IPSourceInfo",false]],"is_mbox() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.is_mbox",false]],"is_outlook_msg() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.is_outlook_msg",false]],"load_ip_db() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_ip_db",false]],"load_psl_overrides() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_psl_overrides",false]],"load_reverse_dns_map() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_reverse_dns_map",false]],"migrate_indexes() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.migrate_indexes",false]],"migrate_indexes() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.migrate_indexes",false]],"module":[[0,"module-parsedmarc",false],[0,"module-parsedmarc.config",false],[0,"module-parsedmarc.elastic",false],[0,"module-parsedmarc.opensearch",false],[0,"module-parsedmarc.splunk",false],[0,"module-parsedmarc.types",false],[0,"module-parsedmarc.utils",false]],"nameservers (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.nameservers",false]],"normalize_timespan_threshold_hours (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.normalize_timespan_threshold_hours",false]],"offline (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.offline",false]],"opensearcherror":[[0,"parsedmarc.opensearch.OpenSearchError",false]],"parse_aggregate_report_file() (in module parsedmarc)":[[0,"parsedmarc.parse_aggregate_report_file",false]],"parse_aggregate_report_xml() (in module parsedmarc)":[[0,"parsedmarc.parse_aggregate_report_xml",false]],"parse_email() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.parse_email",false]],"parse_failure_report() (in module parsedmarc)":[[0,"parsedmarc.parse_failure_report",false]],"parse_forensic_report() (in module parsedmarc)":[[0,"parsedmarc.parse_forensic_report",false]],"parse_report_email() (in module parsedmarc)":[[0,"parsedmarc.parse_report_email",false]],"parse_report_file() (in module parsedmarc)":[[0,"parsedmarc.parse_report_file",false]],"parse_smtp_tls_report_json() (in module parsedmarc)":[[0,"parsedmarc.parse_smtp_tls_report_json",false]],"parsed_aggregate_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_aggregate_reports_to_csv",false]],"parsed_aggregate_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_aggregate_reports_to_csv_rows",false]],"parsed_failure_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_failure_reports_to_csv",false]],"parsed_failure_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_failure_reports_to_csv_rows",false]],"parsed_forensic_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_forensic_reports_to_csv",false]],"parsed_forensic_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_forensic_reports_to_csv_rows",false]],"parsed_smtp_tls_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_smtp_tls_reports_to_csv",false]],"parsed_smtp_tls_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_smtp_tls_reports_to_csv_rows",false]],"parsedemail (class in parsedmarc.types)":[[0,"parsedmarc.types.ParsedEmail",false]],"parsedmarc":[[0,"module-parsedmarc",false]],"parsedmarc.config":[[0,"module-parsedmarc.config",false]],"parsedmarc.elastic":[[0,"module-parsedmarc.elastic",false]],"parsedmarc.opensearch":[[0,"module-parsedmarc.opensearch",false]],"parsedmarc.splunk":[[0,"module-parsedmarc.splunk",false]],"parsedmarc.types":[[0,"module-parsedmarc.types",false]],"parsedmarc.utils":[[0,"module-parsedmarc.utils",false]],"parserconfig (class in parsedmarc.config)":[[0,"parsedmarc.config.ParserConfig",false]],"parsererror":[[0,"parsedmarc.ParserError",false]],"parsingresults (class in parsedmarc.types)":[[0,"parsedmarc.types.ParsingResults",false]],"psl_overrides_path (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.psl_overrides_path",false]],"psl_overrides_url (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.psl_overrides_url",false]],"query_dns() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.query_dns",false]],"reverse_dns_map (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.reverse_dns_map",false]],"reverse_dns_map_path (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.reverse_dns_map_path",false]],"reverse_dns_map_url (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.reverse_dns_map_url",false]],"reversednsservice (class in parsedmarc.utils)":[[0,"parsedmarc.utils.ReverseDNSService",false]],"save_aggregate_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_aggregate_report_to_elasticsearch",false]],"save_aggregate_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_aggregate_report_to_opensearch",false]],"save_aggregate_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_aggregate_reports_to_splunk",false]],"save_failure_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_failure_report_to_elasticsearch",false]],"save_failure_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_failure_report_to_opensearch",false]],"save_failure_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_failure_reports_to_splunk",false]],"save_forensic_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_forensic_report_to_elasticsearch",false]],"save_forensic_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_forensic_report_to_opensearch",false]],"save_forensic_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_forensic_reports_to_splunk",false]],"save_output() (in module parsedmarc)":[[0,"parsedmarc.save_output",false]],"save_smtp_tls_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_smtp_tls_report_to_elasticsearch",false]],"save_smtp_tls_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_smtp_tls_report_to_opensearch",false]],"save_smtp_tls_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_smtp_tls_reports_to_splunk",false]],"seen_aggregate_report_ids (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.seen_aggregate_report_ids",false]],"set_hosts() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.set_hosts",false]],"set_hosts() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.set_hosts",false]],"smtptlsfailuredetails (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSFailureDetails",false]],"smtptlsfailuredetailsoptional (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSFailureDetailsOptional",false]],"smtptlsparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSParsedReport",false]],"smtptlspolicy (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSPolicy",false]],"smtptlspolicysummary (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSPolicySummary",false]],"smtptlsreport (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSReport",false]],"splunkerror":[[0,"parsedmarc.splunk.SplunkError",false]],"strip_attachment_payloads (parsedmarc.config.parserconfig attribute)":[[0,"parsedmarc.config.ParserConfig.strip_attachment_payloads",false]],"timestamp_to_datetime() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.timestamp_to_datetime",false]],"timestamp_to_human() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.timestamp_to_human",false]],"watch_inbox() (in module parsedmarc)":[[0,"parsedmarc.watch_inbox",false]]},"objects":{"":[[0,0,0,"-","parsedmarc"]],"parsedmarc":[[0,1,1,"","InvalidAggregateReport"],[0,1,1,"","InvalidDMARCReport"],[0,1,1,"","InvalidFailureReport"],[0,2,1,"","InvalidForensicReport"],[0,1,1,"","InvalidSMTPTLSReport"],[0,1,1,"","ParserError"],[0,3,1,"","append_json"],[0,0,0,"-","config"],[0,0,0,"-","elastic"],[0,3,1,"","email_results"],[0,3,1,"","email_results_via_msgraph"],[0,3,1,"","extract_report"],[0,3,1,"","extract_report_from_file_path"],[0,3,1,"","get_dmarc_reports_from_mailbox"],[0,3,1,"","get_dmarc_reports_from_mbox"],[0,3,1,"","get_report_zip"],[0,0,0,"-","opensearch"],[0,3,1,"","parse_aggregate_report_file"],[0,3,1,"","parse_aggregate_report_xml"],[0,3,1,"","parse_failure_report"],[0,3,1,"","parse_forensic_report"],[0,3,1,"","parse_report_email"],[0,3,1,"","parse_report_file"],[0,3,1,"","parse_smtp_tls_report_json"],[0,3,1,"","parsed_aggregate_reports_to_csv"],[0,3,1,"","parsed_aggregate_reports_to_csv_rows"],[0,3,1,"","parsed_failure_reports_to_csv"],[0,3,1,"","parsed_failure_reports_to_csv_rows"],[0,3,1,"","parsed_forensic_reports_to_csv"],[0,3,1,"","parsed_forensic_reports_to_csv_rows"],[0,3,1,"","parsed_smtp_tls_reports_to_csv"],[0,3,1,"","parsed_smtp_tls_reports_to_csv_rows"],[0,3,1,"","save_output"],[0,0,0,"-","splunk"],[0,0,0,"-","types"],[0,0,0,"-","utils"],[0,3,1,"","watch_inbox"]],"parsedmarc.config":[[0,4,1,"","ParserConfig"]],"parsedmarc.config.ParserConfig":[[0,2,1,"","always_use_local_files"],[0,2,1,"","dns_retries"],[0,2,1,"","dns_timeout"],[0,2,1,"","ip_address_cache"],[0,2,1,"","ip_db_path"],[0,2,1,"","nameservers"],[0,2,1,"","normalize_timespan_threshold_hours"],[0,2,1,"","offline"],[0,2,1,"","psl_overrides_path"],[0,2,1,"","psl_overrides_url"],[0,2,1,"","reverse_dns_map"],[0,2,1,"","reverse_dns_map_path"],[0,2,1,"","reverse_dns_map_url"],[0,2,1,"","seen_aggregate_report_ids"],[0,2,1,"","strip_attachment_payloads"]],"parsedmarc.elastic":[[0,1,1,"","AlreadySaved"],[0,1,1,"","ElasticsearchError"],[0,3,1,"","create_indexes"],[0,3,1,"","migrate_indexes"],[0,3,1,"","save_aggregate_report_to_elasticsearch"],[0,3,1,"","save_failure_report_to_elasticsearch"],[0,3,1,"","save_forensic_report_to_elasticsearch"],[0,3,1,"","save_smtp_tls_report_to_elasticsearch"],[0,3,1,"","set_hosts"]],"parsedmarc.opensearch":[[0,1,1,"","AlreadySaved"],[0,1,1,"","OpenSearchError"],[0,3,1,"","create_indexes"],[0,3,1,"","migrate_indexes"],[0,3,1,"","save_aggregate_report_to_opensearch"],[0,3,1,"","save_failure_report_to_opensearch"],[0,3,1,"","save_forensic_report_to_opensearch"],[0,3,1,"","save_smtp_tls_report_to_opensearch"],[0,3,1,"","set_hosts"]],"parsedmarc.splunk":[[0,4,1,"","HECClient"],[0,1,1,"","SplunkError"]],"parsedmarc.splunk.HECClient":[[0,5,1,"","close"],[0,5,1,"","save_aggregate_reports_to_splunk"],[0,5,1,"","save_failure_reports_to_splunk"],[0,5,1,"","save_forensic_reports_to_splunk"],[0,5,1,"","save_smtp_tls_reports_to_splunk"]],"parsedmarc.types":[[0,4,1,"","AggregateAlignment"],[0,4,1,"","AggregateAuthResultDKIM"],[0,4,1,"","AggregateAuthResultSPF"],[0,4,1,"","AggregateAuthResults"],[0,4,1,"","AggregateIdentifiers"],[0,4,1,"","AggregateParsedReport"],[0,4,1,"","AggregatePolicyEvaluated"],[0,4,1,"","AggregatePolicyOverrideReason"],[0,4,1,"","AggregatePolicyPublished"],[0,4,1,"","AggregateRecord"],[0,4,1,"","AggregateReport"],[0,4,1,"","AggregateReportMetadata"],[0,4,1,"","EmailAddress"],[0,4,1,"","EmailAttachment"],[0,4,1,"","FailureParsedReport"],[0,4,1,"","FailureReport"],[0,2,1,"","ForensicParsedReport"],[0,2,1,"","ForensicReport"],[0,4,1,"","IPSourceInfo"],[0,4,1,"","ParsedEmail"],[0,4,1,"","ParsingResults"],[0,4,1,"","SMTPTLSFailureDetails"],[0,4,1,"","SMTPTLSFailureDetailsOptional"],[0,4,1,"","SMTPTLSParsedReport"],[0,4,1,"","SMTPTLSPolicy"],[0,4,1,"","SMTPTLSPolicySummary"],[0,4,1,"","SMTPTLSReport"]],"parsedmarc.utils":[[0,1,1,"","DownloadError"],[0,1,1,"","EmailParserError"],[0,4,1,"","IPAddressInfo"],[0,1,1,"","InvalidIPinfoAPIKey"],[0,4,1,"","ReverseDNSService"],[0,3,1,"","configure_ipinfo_api"],[0,3,1,"","convert_outlook_msg"],[0,3,1,"","decode_base64"],[0,3,1,"","get_base_domain"],[0,3,1,"","get_filename_safe_string"],[0,3,1,"","get_ip_address_country"],[0,3,1,"","get_ip_address_db_record"],[0,3,1,"","get_ip_address_info"],[0,3,1,"","get_reverse_dns"],[0,3,1,"","get_service_from_reverse_dns_base_domain"],[0,3,1,"","human_timestamp_to_datetime"],[0,3,1,"","human_timestamp_to_unix_timestamp"],[0,3,1,"","is_mbox"],[0,3,1,"","is_outlook_msg"],[0,3,1,"","load_ip_db"],[0,3,1,"","load_psl_overrides"],[0,3,1,"","load_reverse_dns_map"],[0,3,1,"","parse_email"],[0,3,1,"","query_dns"],[0,3,1,"","timestamp_to_datetime"],[0,3,1,"","timestamp_to_human"]]},"objnames":{"0":["py","module","Python module"],"1":["py","exception","Python exception"],"2":["py","attribute","Python attribute"],"3":["py","function","Python function"],"4":["py","class","Python class"],"5":["py","method","Python method"]},"objtypes":{"0":"py:module","1":"py:exception","2":"py:attribute","3":"py:function","4":"py:class","5":"py:method"},"terms":{"00z":10,"00z_exampl":10,"09t00":10,"09t23":10,"1d":12,"1g":4,"1w":12,"2017a":[3,8],"21vianet":12,"2d":12,"2k":12,"30s":12,"3d":10,"3h":12,"59z":10,"5m":[2,12],"7d":12,"A":[0,3,4,7,12],"AT":10,"After":[2,4,12],"All":[3,8,12],"An":[0,12],"And":0,"As":[4,7],"By":[7,12],"Do":[0,12],"Each":[4,7,12],"For":[0,4,12],"From":[3,8,12],"Further":7,"Have":12,"Here":10,"How":[0,12],"I":12,"IF":12,"If":[0,3,4,6,7,8,12],"In":[0,2,3,7,8,12],"It":[0,2,4,7,10,12],"More":6,"Most":[7,12],"NOT":12,"No":[3,6,8],"Not":[0,12],"On":[3,4,6,7,8,12],"Or":[4,6,12],"So":12,"Some":[2,3,7,8],"Such":0,"That":[0,4,7,12],"The":[0,3,4,6,7,11,12],"Then":[2,3,4,6,8,12],"There":7,"These":[7,12],"This":[0,5,6,7,10,12],"To":[0,2,4,6,7,9,10,12],"Under":[4,7],"What":5,"When":[0,3,5,8,12],"Where":[3,8],"Which":4,"While":[7,12],"With":[0,4,7,12],"YOUR":4,"You":[2,7,12],"_":12,"__getstate__":0,"__init__":0,"__setstate__":0,"_attempt":0,"_cluster":12,"_input":0,"_ipdatabaserecord":0,"_serverless_rejected_set":0,"_sourc":4,"_task":4,"_update_by_queri":[0,4],"aadst":12,"abl":6,"abort":[4,12],"abov":[0,2,4,6,7,12],"absent":4,"accept":[0,3,4,7,8,12],"access":[0,4,5,12],"access_key_id":12,"access_token":0,"accessright":12,"accident":[3,8],"account":[6,7,12],"accumul":0,"acm":10,"acme_corp_dmarc_aggreg":4,"acquir":12,"acquisit":12,"across":[0,7,12],"action":[3,8,12],"activ":[4,5,12],"active_primary_shard":12,"active_shard":12,"actual":[0,3,10],"ad":12,"add":[0,2,3,4,6,7,8,12],"addit":[3,8,12],"address":[0,2,3,4,6,7,8,10,12],"addresse":7,"adjust":4,"adkim":10,"admin":[3,8,12],"administr":[3,8,12],"advanc":7,"affect":0,"afterward":0,"agari":5,"age":12,"agent":4,"agg":7,"aggreg":[0,4,5,11,12],"aggregate_csv_filenam":[0,12],"aggregate_index":0,"aggregate_json_filenam":[0,12],"aggregate_report":[0,12],"aggregate_top":12,"aggregate_url":12,"aggregatealign":0,"aggregateauthresult":0,"aggregateauthresultdkim":0,"aggregateauthresultspf":0,"aggregateidentifi":0,"aggregateparsedreport":0,"aggregatepolicyevalu":0,"aggregatepolicyoverridereason":0,"aggregatepolicypublish":0,"aggregaterecord":0,"aggregatereport":0,"aggregatereportmetadata":0,"alia":[0,12],"alias":12,"align":[4,5,7,10],"aliv":0,"allow":[2,3,8,12],"allow_unencrypted_storag":12,"allowremot":2,"allowstringindic":7,"alon":12,"alongsid":4,"alreadi":[0,4,12],"alreadysav":0,"also":[0,2,3,4,6,7,8,12],"alter":[3,8],"altern":[5,12],"although":11,"alway":[0,2,4,12],"always_use_local_fil":[0,12],"amazon":5,"amd64":12,"amount":12,"analyt":[5,12],"analyz":12,"ani":[0,3,4,6,7,8,12],"anonym":10,"anoth":[4,6,12],"answer":[0,12],"apach":5,"api":[2,4,5,12],"api_key":[0,12],"app":12,"appear":[4,7,12],"append":[0,12],"append_json":0,"appendix":10,"appid":12,"appli":[0,12],"applic":[4,12],"applicationaccesspolici":12,"approach":12,"approxim":2,"apt":[2,4,6],"archiv":0,"archive_directori":12,"archive_fold":[0,12],"argument":[0,12],"arm64":12,"around":12,"array":[0,4],"arraylist":4,"arriv":12,"arrival_d":10,"arrival_date_utc":[0,10],"artifact":4,"as_domain":[0,10],"as_nam":[0,10],"asid":12,"ask":3,"asmx":2,"asn":[0,6,10,12],"aspf":10,"assembl":0,"assert":12,"assign":4,"associ":0,"assum":12,"assume_utc":0,"astimezon":0,"att":10,"attach":[0,3,8,10,12],"attachment_filenam":0,"attempt":[0,12],"attribut":[6,7],"audit":4,"auth":[0,2,4,7,10,12],"auth_failur":10,"auth_method":12,"auth_mod":12,"auth_result":10,"auth_typ":[0,12],"authent":[0,2,3,4,7,12],"authentication_mechan":10,"authentication_result":10,"authentication_typ":12,"auto":2,"automat":[4,6,12],"avail":[0,6,12],"avoid":[7,12],"aw":[0,12],"aws_region":[0,12],"aws_servic":[0,12],"awssigv4":[0,12],"az":12,"azur":[5,12],"b":10,"b2c":7,"back":[0,12],"backend":[0,12],"backfil":[0,5,12],"background":[0,4],"backlog":12,"backward":[0,12],"bare":12,"base":[0,2,3,4,6,7,8,10,12],"base64":0,"base_domain":[0,10],"basic":[0,2,12],"batch":[0,12],"batch_siz":[0,12],"bcc":[0,10],"bd6e1bb5":10,"becaus":[2,3,4,7,8,12],"becom":12,"befor":[0,4,12],"begin":12,"begin_d":10,"behavior":[0,12],"behind":6,"benefit":[0,5],"best":[7,12],"beyond":0,"bin":[2,4,6,12],"binari":[0,12],"binaryio":0,"bind":[0,2],"bindaddress":2,"blank":[3,8],"block":[0,2,4,12],"bodi":[0,3,8,10,12],"bookkeep":0,"bool":[0,4,12],"bound":12,"boundari":[0,12],"box":12,"brand":[0,5,7],"break":[3,4,8],"briefli":12,"broken":[0,12],"broker":12,"browser":4,"bucket":12,"budget":0,"bug":[5,12],"build":6,"built":[0,12],"bundl":[0,6,7,12],"busi":7,"button":[3,8],"byte":0,"c":[10,12],"ca":[4,12],"cach":[0,12],"cafile_path":12,"call":[0,5,12],"callabl":0,"callback":0,"caller":0,"came":[3,8],"can":[0,2,3,4,5,6,7,8,12],"cap":[0,12],"captur":0,"carri":[0,4,6,7,12],"case":[2,3,8,12],"catch":[0,12],"caught":0,"caus":[3,4,7,8,12],"cc":[0,10],"center":7,"cento":[4,6],"central":0,"cert":[4,12],"cert_path":12,"certain":[0,12],"certfile_path":12,"certif":[0,4,7,12],"certificate_password":12,"certificate_path":12,"cest":10,"cfg":0,"chain":0,"chang":[4,7,11,12],"charact":[2,12],"charset":10,"chart":7,"cheap":[0,4],"check":[0,2,3,4,7,12],"check_timeout":[0,12],"checkbox":4,"checkdmarc":3,"china":12,"chinacloudapi":12,"chines":7,"chmod":[2,4,12],"choos":[3,8],"chown":[2,12],"ci":7,"circular":0,"cisco":12,"class":[0,4],"classifi":0,"clean":[0,12],"clear":0,"cli":[0,5],"click":[4,7],"client":[2,3,4,8,12],"client_assert":12,"client_id":12,"client_secret":12,"clientassert":12,"clientsecret":12,"clientsotimeout":2,"clock":0,"close":[0,12],"cloud":[0,12],"cloudflar":[0,12],"cluster":[0,4,12],"cn":12,"co":4,"code":[0,4,12],"collect":[7,12],"collector":[11,12],"column":7,"com":[1,2,3,8,9,10,12],"combin":[0,5,7,12],"come":[0,7,12],"comfort":12,"comma":[6,12],"command":[0,2,3,4,6,8,12],"comment":12,"commerci":[4,5],"commit":0,"common":[3,4,6,8],"communiti":[3,8],"compat":[0,7,12],"complet":[0,3,4,12],"compli":[3,4,6,8,9],"complianc":7,"compliant":[3,8],"compon":[0,6,7],"compress":5,"comput":7,"condit":7,"conf":6,"config":[2,5,6],"config_fil":12,"config_reload":0,"configur":[0,3,4,5,6,7,8,9],"configure_ipinfo_api":0,"confirm":12,"conflict":4,"conform":4,"connect":[0,2,4,12],"connection_str":12,"consent":12,"consid":[5,7],"consist":[0,5,10],"consol":[4,12],"constant":0,"construct":[0,12],"consult":[4,6],"consum":[7,12],"contact":[7,12],"contain":[0,7,11,12],"content":[0,3,4,8,10,11,12],"continu":4,"contrib":6,"contribut":5,"control":[0,4,12],"convent":12,"convert":[0,3,8],"convert_outlook_msg":0,"copi":[0,6,11,12],"core":[3,8],"correct":[0,6,7,12],"correspond":[4,12],"corrupt":0,"count":[0,2,4,7,10,12],"counter":0,"countri":[0,7,10,12],"country_cod":0,"cover":[4,12],"cpan":6,"cr":12,"crash":[2,4,12],"creat":[0,2,3,4,6,8,12],"create_fold":0,"create_index":0,"creation":12,"creativ":6,"credenti":[4,6,12],"credentials_fil":12,"cron":[6,12],"cross":0,"crt":4,"csr":4,"csv":[0,5,12],"csvs":12,"ctrl":12,"ctx":4,"cumul":6,"curl":4,"current":[0,2,4,12],"custom":[4,7,12],"d":[0,4,12],"daemon":[2,4,12],"daili":[0,12],"dashboard":[4,5,9,11],"dat":0,"data":[0,4,5,6,7,9,11,12],"databas":[0,12],"dataclass":0,"date":[0,3,8,10,12],"date_utc":10,"datetim":0,"davmail":5,"day":[0,4,9,12],"db_path":0,"dbip":[0,6,12],"dbname":12,"dce":12,"dcr":12,"dcr_aggregate_stream":12,"dcr_failure_stream":12,"dcr_immutable_id":12,"dcr_smtp_tls_stream":12,"dd":[0,12],"de":[0,10],"dearmor":4,"deb":4,"debian":[4,5,6],"debug":[0,4,12],"decemb":6,"declar":0,"decod":0,"decode_base64":0,"dedic":6,"dedup":0,"dedupl":[0,12],"deeper":4,"def":4,"default":[0,2,4,5,6,7,12],"default_factori":0,"defeat":0,"defect":4,"defens":[4,5],"defin":0,"delay":[0,2,10,12],"deleg":12,"delegated_us":12,"delet":[0,2,4,12],"delete_aggreg":[0,12],"delete_failur":[0,12],"delete_invalid":[0,12],"delete_smtp_tl":[0,12],"deliber":[0,4,12],"deliveri":[0,12],"delivery_result":10,"demystifi":3,"deni":12,"depend":[0,4,5,12],"deploy":[3,4,8,12],"deprec":[7,12],"depth":4,"deriv":0,"describ":12,"descript":[2,6,12],"design":12,"destin":[0,12],"det":4,"detail":[0,4,6,7,12],"detect":12,"determin":12,"dev":[6,12],"devel":6,"develop":5,"devicecod":12,"dict":0,"dictionari":0,"didn":12,"differ":[7,12],"difficult":12,"dig":0,"digest":[3,8],"dir":6,"direct":[7,12],"directori":[0,6,12],"dis":10,"disabl":[0,2,6,12],"disclaim":[3,8],"disk":[0,12],"display":[3,7,11],"display_nam":10,"disposit":[0,7,10],"distinguish":12,"distribut":6,"distro":6,"dk":4,"dkim":[0,5,7,8,10,12],"dkim_align":10,"dkim_domain":10,"dkim_result":[4,10],"dkim_results_combin":[0,4],"dkim_selector":10,"dkm":3,"dmarc":[0,4,6,8,9,10,11,12],"dmarc_aggreg":[4,7],"dmarc_align":10,"dmarc_failur":4,"dmarc_moderation_act":[3,8],"dmarc_none_moderation_act":[3,8],"dmarc_quarantine_moderation_act":[3,8],"dmarcian":5,"dmarcresport":12,"dnf":6,"dns":[0,3,6,7,12],"dns_retri":[0,12],"dns_test_address":12,"dns_timeout":[0,12],"dnspython":0,"doc":[0,9,12],"doctyp":10,"document":[0,2,4,7,12],"dod":12,"doe":[0,3,4,8,12],"doesn":[0,12],"dom":4,"domain":[0,4,7,8,10,12],"domainawar":[1,3,12],"don":3,"doubl":12,"download":[0,2,4,6,12],"downloaderror":0,"dr":4,"draft":[5,10,12],"drop":0,"dropdown":7,"dsn":12,"dtd":10,"dummi":12,"duplic":0,"dure":[2,12],"e":[0,2,3,4,6,8,12],"e7":10,"earlier":[0,7],"easi":[4,9],"easier":[11,12],"echo":4,"edit":[2,6,7,12],"editor":11,"effect":12,"effici":4,"either":[0,4,5,12],"elast":[4,5,7,12],"elasticsearch":[0,5,12],"elasticsearcherror":0,"elig":12,"elk":12,"els":[4,12],"email":[0,3,5,6,7,8,10,11,12],"email_result":0,"email_results_via_msgraph":0,"emailaddress":0,"emailattach":0,"emailparsererror":0,"empti":[0,3,4,8,12],"en":[3,4,8,10],"enabl":[2,4,7,12],"enableew":2,"enablekeepal":2,"enableproxi":2,"encod":[0,10,12],"encount":0,"encrypt":[4,12],"encryptedsavedobject":4,"encryptionkey":4,"end":[0,3,4,5,12],"end_dat":10,"endpoint":[5,12],"endpoint_url":12,"enforc":[3,8],"enough":12,"enrich":[0,6,12],"enrol":4,"ensur":[3,4,6,8],"enterpris":12,"entir":[0,3,7,8,12],"entra":12,"entri":[0,12],"envelop":3,"envelope_from":10,"envelope_to":10,"environ":[5,6],"eof":0,"eol":5,"epel":6,"equal":0,"equival":4,"error":[0,4,7,10,12],"erroritemnotfound":12,"es":[0,12],"escap":12,"especi":[7,12],"etc":[0,2,3,4,6,8,12],"even":[2,3,8,12],"event":[2,11,12],"everi":[0,2,4,6,7,12],"everyth":12,"ew":5,"ex":12,"exact":[0,3,8,12],"exampl":[3,4,6,8,10],"exceed":[0,7],"except":[0,12],"exchang":[2,10,12],"exclud":[2,12],"execreload":12,"execstart":[2,12],"exercis":0,"exhaust":12,"exist":[0,3,4,8,12],"exit":[0,12],"expect":12,"expens":0,"expir":12,"expiri":7,"expiringdict":0,"explain":[3,8],"explicit":[0,3,6,8,12],"export":[0,4,7,12],"extens":12,"extra":12,"extract":[0,2],"extract_report":0,"extract_report_from_file_path":0,"eye":[2,12],"f":[0,4],"factor":2,"factori":0,"fail":[0,3,7,8,10,12],"fail_on_output_error":12,"failed_sess":7,"failed_session_count":10,"failov":0,"failur":[0,4,5,11,12],"failure_csv_filenam":[0,12],"failure_detail":[4,10],"failure_details_combin":[0,4],"failure_index":0,"failure_json_filenam":[0,12],"failure_report":0,"failure_top":12,"failure_url":12,"failureparsedreport":0,"failurereport":0,"fall":[0,12],"fallback":[0,12],"fals":[0,2,4,10,12],"fantast":[3,8],"fast":0,"faster":12,"fatal":[0,12],"favor":[0,12],"fds":4,"featur":[4,12],"feedback":0,"feedback_report":0,"feedback_typ":10,"fetch":[0,7,12],"field":[0,5,7,12],"file":[0,2,5,6,7,11],"file_path":[0,12],"filenam":[0,12],"filename_safe_subject":10,"filepath":12,"fill":[4,6],"filter":[0,3,7,8,11,12],"final":5,"financ":12,"find":[3,7,8,12],"fine":[3,8],"finish":12,"first":[0,3,6,7,8,12],"first_strip_reply_to":[3,8],"fit":[3,8,12],"fix":[0,4,12],"flag":[0,2,6,12],"flat":0,"flexibl":11,"flight":12,"float":[0,12],"flush":12,"fo":[0,10],"fold":0,"folder":[0,2,12],"foldersizelimit":2,"follow":[2,4,5,12],"footer":[3,8],"forc":12,"foreground":12,"forens":[5,7,12],"forensicparsedreport":0,"forensicreport":0,"forev":12,"form":12,"format":[0,7,12],"former":[5,7,12],"forward":[3,7,8],"found":[0,4,6,12],"foundat":10,"four":12,"fqdn":4,"fraud":5,"free":[6,12],"fresh":[0,4,12],"freshest":12,"friend":7,"from_is_list":[3,8],"frozen":0,"ftp_proxi":6,"full":[0,12],"fulli":[0,3,4,7,8,12],"function":[0,12],"functool":0,"g":[0,2,3,4,6,8,12],"gateway":2,"gb":4,"gcc":[6,12],"gdpr":[4,9],"gelf":[5,12],"general":[3,4,6,8,12],"generat":[3,4,8,10],"geoip":[0,6,12],"geoipupd":6,"geolite2":5,"geoloc":[0,12],"get":[0,2,4,6,12],"get_base_domain":0,"get_dmarc_reports_from_mailbox":[0,12],"get_dmarc_reports_from_mbox":[0,12],"get_filename_safe_str":0,"get_ip_address_countri":0,"get_ip_address_db_record":0,"get_ip_address_info":0,"get_report_zip":0,"get_reverse_dn":0,"get_service_from_reverse_dns_base_domain":0,"ghcr":12,"github":[0,1,6,10,12],"give":[0,4],"given":[0,12],"glass":7,"glob":12,"global":12,"gmail":[0,5,7,12],"gmail_api":12,"go":[0,3,8],"goe":[3,8],"googl":[7,12],"googleapi":12,"got":12,"gov":12,"govern":12,"gpg":4,"grafana":5,"grant":12,"graph":[0,2,5,7,12],"graph_url":12,"graylog":5,"group":[2,7,12],"guard":0,"guid":[4,5],"guidanc":12,"gz":12,"gzip":[0,5],"h":[0,4,12],"hamburg":4,"hand":[3,8],"handl":[0,5,12],"handler":[7,12],"happen":[0,4,12],"hard":12,"has_defect":10,"hasn":12,"head":10,"header":[0,3,7,8,10,12],"header_from":10,"headless":2,"health":12,"healthcar":12,"heap":4,"heavi":4,"hec":[0,11,12],"hecclient":0,"hectokengoesher":12,"held":[0,12],"help":5,"hh":0,"hierarchi":12,"high":[7,12],"higher":[3,8],"histor":[4,12],"histori":12,"hit":[0,12],"hold":[0,12],"home":6,"hop":10,"host":[0,2,3,4,5,8,12],"hostnam":[0,12],"hour":[0,12],"hover":7,"href":10,"html":[3,4,8,10],"http":[0,2,4,5,6,10,11,12],"http_proxi":6,"https":[0,1,2,3,4,6,8,9,12],"https_proxi":6,"httpx":12,"human":[0,7],"human_timestamp":0,"human_timestamp_to_datetim":0,"human_timestamp_to_unix_timestamp":0,"hup":12,"icon":7,"id":[0,3,4,8,10,12],"ideal":[3,8],"idempot":[4,12],"ident":[0,3,4,8,12],"identifi":10,"idl":[0,2,12],"ignor":[0,12],"imag":12,"imap":[0,2,5,12],"imap_password":12,"imapalwaysapproxmsgs":2,"imapautoexpung":2,"imapcli":5,"imapconnect":12,"imapidledelay":2,"imapport":2,"immedi":[2,12],"immut":12,"impli":12,"import":[0,4,7,12],"improv":12,"inbox":[0,3,5,8,12],"inc":10,"includ":[0,3,4,6,7,8,12],"include_list_post_head":[3,8],"include_rfc2369_head":[3,8],"include_sender_head":[3,8],"include_spam_trash":12,"incom":[7,12],"incorrect":12,"increas":[4,12],"increment":12,"indefinit":12,"indent":12,"independ":0,"index":[0,5,7,9,11,12],"index_prefix":[0,4,12],"index_prefix_domain_map":[4,12],"index_suffix":[0,4,12],"indic":[3,5],"individu":[0,7,12],"industri":12,"info":[0,12],"inform":[0,4,7,12],"infrequ":12,"ingest":12,"inherit":[0,12],"ini":[2,12],"init":0,"initi":[0,12],"inner":12,"input":[0,12],"input_":0,"insid":[4,12],"inspect":[0,12],"instal":[0,2,5,12],"installed_app":12,"instanc":[0,12],"instanceof":4,"instead":[0,3,4,6,8,12],"instruct":4,"int":[0,12],"integ":0,"intend":[3,8],"intent":0,"interact":[2,4,12],"interakt":10,"interfer":[3,8],"interleav":0,"interpret":[0,6],"interrupt":12,"interval":12,"interval_begin":10,"interval_end":10,"introduc":0,"invalid":[0,12],"invalidaggregatereport":0,"invaliddmarcreport":0,"invalidfailurereport":0,"invalidforensicreport":0,"invalidipinfoapikey":0,"invalidsmtptlsreport":0,"invis":4,"invok":0,"involv":7,"io":[0,12],"ip":[0,3,4,7,12],"ip_address":[0,10],"ip_address_cach":0,"ip_db_path":[0,6,12],"ip_db_url":12,"ipaddressinfo":0,"ipinfo":[0,6,12],"ipinfo_api_token":12,"ipinfo_url":12,"ipsourceinfo":0,"ipv4":0,"ipv6":0,"is_mbox":0,"is_outlook_msg":0,"iso":[0,12],"isol":[0,12],"issu":[0,1,12],"item":[0,12],"java":2,"job":[3,6,8],"joe":[3,8],"journalctl":[2,12],"jre":2,"json":[0,4,5,12],"june":5,"junk":12,"just":[4,7,12],"jvm":4,"jwt":12,"kafka":[5,12],"kb4099855":6,"kb4134118":6,"kb4295699":6,"keep":[0,4,7,12],"keep_al":[0,12],"keepal":2,"kept":0,"key":[0,3,4,6,12],"keyfile_path":12,"keyout":4,"keyr":4,"keystor":4,"keyword":[0,12],"kibana":[5,11],"kill":12,"killsign":12,"kind":12,"know":3,"known":[0,3,7,8,12],"kubernet":12,"kwarg":0,"l4":12,"l5":12,"label":12,"lack":4,"lang":4,"languag":[3,8],"larg":[2,12],"larger":12,"last":6,"later":[0,4,6,12],"latest":[2,4,9,12],"layer":0,"layout":11,"leak":7,"least":[4,6,12],"leav":[0,3],"left":[0,7,12],"legaci":[0,5],"legacy_fo_index":0,"legal":[3,8],"legitim":[7,12],"less":12,"let":0,"level":[0,3,4,12],"lf":12,"libemail":6,"libpq":12,"librari":5,"libxml2":6,"libxslt":6,"licens":6,"life":5,"lifetim":0,"lifetimetimeout":0,"like":[0,3,6,7,8,12],"limit":[0,2,12],"line":[3,8,12],"link":[3,4,7,8],"linux":[3,6,8],"list":[0,2,4,5,7,12],"listen":[2,12],"lite":[0,6,12],"live":[7,12],"ll":[3,8],"load":[0,4,12],"load_ip_db":0,"load_psl_overrid":0,"load_reverse_dns_map":0,"local":[0,2,4,6,10,12],"local_file_path":0,"local_psl_overrides_path":12,"local_reverse_dns_map_path":12,"localhost":[4,12],"locat":[0,7,12],"log":[0,2,4,5,12],"log_analyt":12,"log_fil":12,"logger":12,"login":[4,12],"logstash":4,"long":[0,3,12],"longer":[3,6,8],"look":[0,3,7],"lookup":[0,12],"loop":[0,12],"loopback":2,"lose":12,"loss":0,"lot":7,"low":12,"lower":12,"lua":10,"m":[0,6,12],"m365":12,"maco":6,"magnifi":7,"mail":[0,5,6,10,12],"mail_bcc":0,"mail_cc":0,"mail_from":0,"mail_to":0,"mailbox":[0,7],"mailbox_check_timeout":12,"mailbox_connect":0,"mailboxconnect":0,"maildir":[0,12],"maildir_cr":12,"maildir_path":12,"mailer":10,"mailrelay":10,"mailsuit":[0,12],"mailto":6,"main":[4,12],"mainpid":12,"maintain":5,"make":[0,3,4,6,8,9,12],"malici":[7,12],"manag":[4,7,12],"mandatori":12,"mani":[0,12],"manual":[0,4,12],"map":[0,4],"mariadb":12,"market":7,"massiv":12,"match":[0,4,7,11,12],"max_ag":10,"max_shards_per_nod":12,"max_unsaved_retri":[0,12],"maximum":4,"maxmind":[0,5,12],"may":[0,5,7,12],"mbox":[0,12],"md":0,"mean":[0,12],"meantim":0,"mechan":3,"member":[3,8,12],"memori":[0,12],"mention":7,"menu":[4,7],"mere":0,"merg":0,"messag":[0,2,3,4,6,7,8,10],"message_id":10,"meta":10,"method":12,"metric":7,"mfrom":[4,10],"microsoft":[0,2,5,10,12],"microsoftgraph":12,"microsoftonlin":12,"mid":12,"might":[0,3,7,8],"migrat":[0,7,12],"migrate_index":0,"mime":10,"min":0,"mind":12,"minim":12,"minimum":[4,12],"minimum_should_match":4,"minut":[0,2,12],"mirror":0,"miss":[4,6,12],"mitig":[3,8],"mix":0,"mm":[0,12],"mmdb":[0,6,12],"mobil":[3,8],"mode":[0,2,4,6,10],"modern":[2,3,8],"modifi":[0,3,8,12],"modul":[0,5,6,12],"mon":10,"monitor":[3,12],"month":[0,12],"monthly_index":[0,12],"mous":7,"move":[0,4,12],"ms":[0,10,12],"msal":12,"msg":[0,6],"msg_byte":0,"msg_date":0,"msg_footer":[3,8],"msg_header":[3,8],"msgconvert":[0,6],"msgraph":12,"msgraphconnect":0,"mta":7,"much":12,"multi":[0,2,5],"multipl":[0,7,12],"multipli":12,"multiprocess":0,"mung":[3,8],"must":[0,2,3,4,8,12],"must_not":4,"mutat":0,"mutual":[4,12],"mv":4,"mx":[7,10],"n":[0,10,12],"n_proc":[0,12],"naiv":0,"name":[0,3,4,7,10,11],"nameserv":[0,12],"nano":[2,12],"nation":12,"navig":[3,8],"ncontent":10,"ndate":10,"ndjson":[4,7],"necessarili":7,"need":[0,2,3,4,6,7,8,12],"negat":[0,12],"neither":[0,12],"nelson":[3,8],"net":[2,12],"network":[0,2,4,12],"never":[0,4,12],"new":[0,2,4,5,6,7,12],"newer":6,"newest":[2,12],"newkey":4,"newli":[0,4,12],"news":3,"next":[0,4,12],"nfrom":10,"nmessag":10,"nmime":10,"node":4,"nologin":6,"non":[0,3,4,8,12],"nonameserv":0,"none":[0,3,4,10,12],"noproxyfor":2,"norepli":[3,10],"normal":[0,10,12],"normalize_timespan_threshold_hour":0,"normalized_timespan":10,"nosecureimap":2,"notabl":7,"note":[0,4,12],"noth":[4,12],"notic":12,"now":[0,4,6,7,12],"nowher":12,"nsubject":10,"nto":10,"null":[4,6,10],"number":[0,7,12],"number_of_replica":[0,12],"number_of_shard":[0,12],"numer":12,"nwettbewerb":10,"nx":10,"o":[2,4,12],"oR":6,"oauth2":12,"oauth2_port":12,"object":[0,4,7,12],"observ":[7,12],"occur":[0,7],"occurr":11,"oct":10,"offic":2,"office365":2,"offici":12,"offlin":[0,6,12],"offset":[0,12],"often":[7,12],"old":7,"older":[4,6,10,12],"oldest":[2,12],"ole":[0,6],"omit":[0,12],"onboard":[4,12],"onc":[0,4,7],"ondmarc":5,"one":[0,3,4,5,6,7,8,12],"onli":[0,2,3,4,6,7,8],"onlin":[0,2,12],"onto":0,"oor":0,"op":0,"open":[0,3],"opendn":12,"opensearch":[4,5,7,12],"opensearch_dashboard":7,"opensearcherror":0,"openssl":4,"oper":12,"opt":[2,6,12],"option":[0,2,3,4,5,8,11,12],"orchestr":[0,12],"order":12,"org":[0,6,9,10,12],"org_email":10,"org_extra_contact_info":10,"org_nam":10,"organiz":[2,5,7,12],"organization_nam":10,"origin":[0,3,8,12],"original_envelope_id":10,"original_mail_from":10,"original_rcpt_to":10,"original_timespan_second":10,"os":0,"oserror":0,"otherwis":[0,12],"outag":12,"outdat":7,"outgo":[3,8,12],"outlook":[0,2,6,12],"output":[0,5,12],"output_directori":0,"outsid":12,"overal":0,"overrid":[0,6,12],"overwrit":[0,4,12],"overwritten":12,"owa":[5,12],"owned":6,"ownership":6,"owns":[0,12],"p":[3,4,10],"p12":4,"pack":4,"packag":[0,4,6,12],"packet":0,"pad":[0,12],"page":[3,4,6,7,8],"paginate_messag":12,"painless":4,"pair":[4,7],"pan":10,"panel":7,"parallel":[0,12],"paramet":[0,12],"parent":7,"pars":[0,3,5,6,10,12],"parse_aggregate_report_fil":[0,12],"parse_aggregate_report_xml":[0,12],"parse_email":0,"parse_failure_report":[0,12],"parse_forensic_report":0,"parse_report_email":[0,12],"parse_report_fil":[0,12],"parse_smtp_tls_report_json":0,"parsed_aggregate_reports_to_csv":0,"parsed_aggregate_reports_to_csv_row":0,"parsed_failure_reports_to_csv":0,"parsed_failure_reports_to_csv_row":0,"parsed_forensic_reports_to_csv":0,"parsed_forensic_reports_to_csv_row":0,"parsed_sampl":10,"parsed_smtp_tls_reports_to_csv":0,"parsed_smtp_tls_reports_to_csv_row":0,"parsedemail":0,"parsedmarc":[4,9,10,11],"parsedmarc_":12,"parsedmarc_config_fil":12,"parsedmarc_debug":12,"parsedmarc_elasticsearch_":12,"parsedmarc_elasticsearch_host":12,"parsedmarc_elasticsearch_ssl":12,"parsedmarc_gelf_":12,"parsedmarc_general_":12,"parsedmarc_general_debug":12,"parsedmarc_general_ipinfo_api_token":12,"parsedmarc_general_ipinfo_url":12,"parsedmarc_general_offlin":12,"parsedmarc_general_save_aggreg":12,"parsedmarc_general_save_failur":12,"parsedmarc_gmail_api_":12,"parsedmarc_gmail_api_credentials_file_fil":12,"parsedmarc_imap_":12,"parsedmarc_imap_host":12,"parsedmarc_imap_password":12,"parsedmarc_imap_password_fil":12,"parsedmarc_imap_us":12,"parsedmarc_kafka_":12,"parsedmarc_log_analytics_":12,"parsedmarc_mailbox_":12,"parsedmarc_mailbox_watch":12,"parsedmarc_maildir_":12,"parsedmarc_msgraph_":12,"parsedmarc_opensearch_":12,"parsedmarc_s3_":12,"parsedmarc_smtp_":12,"parsedmarc_splunk_hec_":12,"parsedmarc_splunk_hec_index":12,"parsedmarc_splunk_hec_token":12,"parsedmarc_splunk_hec_url":12,"parsedmarc_syslog_":12,"parsedmarc_webhook_":12,"parser":0,"parserconfig":[0,12],"parsererror":0,"parsingresult":0,"part":[0,3,4,7,8,12],"partial":0,"particular":[7,12],"pass":[0,3,4,7,10,12],"passsword":12,"password":[0,4,6,12],"paste":[4,11],"patch":6,"path":[0,4,6,12],"pathlik":0,"pattern":[0,5,7,12],"pay":12,"payload":[0,12],"pct":10,"peak":12,"pem":12,"per":[0,4,7,12],"percentag":7,"perform":[2,5],"period":12,"perl":[0,6],"perman":12,"permiss":[4,12],"persist":[0,12],"peter":10,"phase":0,"pick":[6,12],"pickl":0,"pickup":6,"pid":12,"pie":7,"pin":12,"pip":[6,12],"pipelin":0,"pkcs12":12,"place":[0,4,7,12],"plain":[0,12],"plaintext":[3,8],"platform":[3,6,8,12],"pleas":[1,5,12],"plug":12,"plus":[0,4,7,12],"point":[4,6,12],"pol":4,"polici":[0,3,4,7,8,10,12],"policies_combin":[0,4],"policy_domain":[4,10],"policy_evalu":10,"policy_override_com":10,"policy_override_reason":10,"policy_publish":10,"policy_str":10,"policy_typ":[4,10],"policyscopegroupid":12,"poll":[0,2,12],"popul":0,"port":[0,2,12],"portal":12,"posit":[0,12],"posix":0,"possibl":12,"post":[3,4,8,12],"poster":[3,8],"postgr":12,"postgresql":[5,12],"postorius":[3,8],"powershel":12,"ppa":6,"pre":[0,6,12],"prebuilt":12,"predict":12,"prefer":[2,6,12],"prefix":[0,3,4,8,12],"premad":[5,11],"prepend":0,"prerequisit":5,"present":12,"preserv":0,"pressur":12,"pretti":12,"prettifi":12,"previous":[0,2,4,6,12],"pri":[2,12],"primari":0,"print":12,"printabl":10,"prior":0,"prioriti":12,"privaci":[3,6,7,8,12],"privat":12,"probe":0,"problem":12,"proc":12,"proceed":4,"process":[0,2,5,6,12],"produc":[0,10],"program":12,"programdata":6,"progress":[4,12],"project":[0,2,3,5,11,12],"prompt":4,"proofpoint":5,"propag":0,"properti":2,"protect":[2,3,5,8,12],"protocol":12,"provid":[0,4,7,12],"provis":12,"prox":6,"proxi":2,"proxyhost":2,"proxypassword":2,"proxyport":2,"proxyus":2,"ps":4,"psl":[0,12],"psl_overrid":0,"psl_overrides_path":0,"psl_overrides_url":[0,12],"psycopg":12,"public":[0,3,10,12],"public_suffix_list":0,"publicbaseurl":4,"publicsuffix":0,"publish":[3,12],"published_polici":0,"pull":12,"purpos":4,"put":[4,12],"py":0,"python":[0,4,6,12],"python3":6,"qo":4,"quarantin":[3,8],"queri":[0,4,12],"query_dn":0,"quick":0,"quickstart":12,"quit":12,"quot":[10,12],"quota":[0,12],"r":[2,10,12],"rais":[0,12],"ram":[4,12],"rate":[0,12],"rather":[0,3,4,7,8,12],"ratio":7,"raw":12,"re":[0,4,6,12],"reach":[0,4,12],"reachabl":12,"read":[0,4,12],"readabl":[0,12],"readwrit":12,"real":[0,7],"realli":3,"reason":[0,2,4,5,12],"rebind":0,"rebuilt":0,"receiv":[0,7,10,12],"receiveddatetim":12,"receiving_ip":[4,10],"receiving_mx_hostnam":[4,10],"recent":0,"recipi":7,"recogn":[7,12],"recommend":12,"recommended_dns_nameserv":0,"record":[0,5,6,10,12],"record_typ":0,"recov":[0,12],"recurs":12,"redact":12,"redi":12,"reduc":[6,12],"refactor":0,"refer":[4,5,7,12],"referenc":12,"refresh":[6,12],"refresh_interv":12,"refus":4,"regard":12,"regardless":[0,10,12],"region":[0,12],"region_nam":12,"regist":[6,12],"registr":12,"regul":[4,6,9,12],"regular":[3,8,12],"reindex":0,"reject":[0,3,8,12],"relat":[3,12],"relay":[3,8],"releas":[0,4,6],"reli":[6,7],"reliabl":12,"reload":[0,2,4],"remain":[0,7,12],"remot":2,"remov":[0,3,4,8,12],"render":7,"repars":0,"repeat":[0,3,8,12],"replac":[0,3,4,8,12],"repli":[2,3,8],"replic":12,"replica":[0,12],"reply_goes_to_list":[3,8],"reply_to":10,"replyto":[3,8],"repopul":0,"report":[0,4,11],"report_id":10,"report_metadata":10,"report_typ":0,"reported_domain":10,"reports_fold":[0,12],"repositori":[6,11],"req":4,"request":[0,2,4,12],"requir":[0,2,3,4,5,6,7,8,12],"require_encrypt":0,"res":4,"reserv":12,"reset":0,"resid":12,"resolv":[0,12],"resort":6,"resourc":[0,4,5,12],"respect":7,"respons":[0,12],"rest":[0,12],"restart":[2,3,4,6,8],"restartsec":[2,12],"restor":4,"restrict":12,"restrictaccess":12,"restructur":7,"result":[0,5,7,10,12],"result_typ":[4,10],"resum":12,"retain":[3,8,12],"retent":[0,5],"retri":[0,4,12],"retriev":2,"retry_attempt":12,"retry_delay":12,"return":[0,4],"revers":[0,6,7,12],"reverse_dn":[0,10],"reverse_dns_base_domain":0,"reverse_dns_map":0,"reverse_dns_map_path":0,"reverse_dns_map_url":[0,12],"reversednsservic":0,"review":7,"rewrit":[0,3,8],"rfc":[0,3,5,8,10],"rfc2369":[3,8],"rfc822":2,"rhel":[4,5,6],"ri":4,"right":[4,7],"rm":4,"rmh":4,"rocki":6,"rollup":6,"root":[2,12],"rough":12,"row":7,"rpm":4,"rpt":[5,7],"rsa":4,"rt":4,"rua":[5,6],"ruf":[5,6,7,12],"rule":[7,12],"run":[0,4,5,6],"runtimeerror":12,"rw":[2,12],"s":[0,2,3,4,6,7,8,10,12],"s3":[5,12],"safe":[0,4,12],"sampl":[0,5,7,12],"sample_headers_on":10,"satisfi":7,"save":[0,4,6,7],"save_aggreg":12,"save_aggregate_report_to_elasticsearch":0,"save_aggregate_report_to_opensearch":0,"save_aggregate_reports_to_splunk":0,"save_callback":0,"save_failur":12,"save_failure_report_to_elasticsearch":0,"save_failure_report_to_opensearch":0,"save_failure_reports_to_splunk":0,"save_forens":12,"save_forensic_report_to_elasticsearch":0,"save_forensic_report_to_opensearch":0,"save_forensic_reports_to_splunk":0,"save_output":0,"save_smtp_tl":12,"save_smtp_tls_report_to_elasticsearch":0,"save_smtp_tls_report_to_opensearch":0,"save_smtp_tls_reports_to_splunk":0,"say":[0,12],"sbin":6,"sc":4,"scalar":4,"schedul":[6,12],"schema":[5,10,12],"scheme":0,"scope":[4,7,10,12],"script":[4,6],"scrub_nondigest":[3,8],"sdk":12,"search":[0,3,4,8,12],"second":[0,2,12],"secret_access_key":12,"section":4,"secur":[0,4,12],"see":[0,2,3,4,6,7,12],"seek":0,"seen":[0,12],"seen_aggregate_report_id":0,"segment":7,"sel":4,"select":0,"selector":[4,7,10],"self":[4,5],"send":[0,2,3,4,5,7,8,11,12],"sender":[0,5,7,8],"sending_mta_ip":[4,10],"sendmail":[0,12],"sensit":12,"sent":[0,3,8,12],"sentinel":5,"separ":[0,3,4,6,7,9,11,12],"sequenc":0,"sequenti":[0,12],"serial":[0,12],"server":[0,2,3,4,5,6,7,10,12],"server_ip":4,"serverless":[0,12],"servernameon":10,"servic":[0,3,4,5,6,7,8,10],"service_account":12,"service_account_us":12,"session":[0,7],"set":[0,2,3,4,6,7,8,9,12],"set_host":0,"setup":[4,6,9,12],"shape":[0,4,12],"shard":[0,12],"share":[0,4,6,7,12],"sharealik":6,"sharepoint":10,"shell":6,"ship":[6,12],"short":12,"shot":[0,12],"shouldn":[3,8],"show":[2,7,12],"shown":[6,7,12],"shutdown":[0,12],"sibl":7,"side":[7,12],"sighup":[0,4,6,12],"sigkil":12,"sign":[0,3,4,6,12],"signal":12,"signatur":[3,7,8],"sigterm":[0,12],"sigv4":[0,12],"silent":[0,6,12],"similar":7,"simpl":5,"simpli":[0,12],"simplifi":0,"sinc":[0,6,7,12],"singl":[0,7,12],"sink":12,"sister":3,"six":12,"size":[2,4],"skel":6,"skip":[0,4,12],"skip_certificate_verif":[0,12],"slight":11,"slow":0,"small":[4,12],"smaller":12,"smi":4,"smtp":[0,3,4,5,12],"smtp_tls":[0,4,12],"smtp_tls_csv_filenam":[0,12],"smtp_tls_index":0,"smtp_tls_json_filenam":[0,12],"smtp_tls_report":0,"smtp_tls_url":12,"smtptlsfailuredetail":0,"smtptlsfailuredetailsopt":0,"smtptlsparsedreport":0,"smtptlspolici":0,"smtptlspolicysummari":0,"smtptlsreport":0,"socket":2,"solut":6,"somehow":12,"someon":4,"sometim":12,"sort":12,"sourc":[0,3,4,6,7,10],"source_as_domain":10,"source_as_nam":10,"source_asn":10,"source_base_domain":10,"source_countri":10,"source_ip_address":10,"source_nam":10,"source_reverse_dn":10,"source_typ":10,"sourceforg":2,"sovereign":12,"sp":[3,4,10],"spam":12,"spawn":0,"special":12,"specif":[0,3,6,7,12],"specifi":[2,3],"spf":[0,5,7,10,12],"spf_align":10,"spf_domain":10,"spf_result":[4,10],"spf_results_combin":[0,4],"spf_scope":10,"split":0,"splunk":[5,12],"splunk_hec":12,"splunkerror":0,"splunkhec":12,"sponsor":5,"spoof":[3,8],"spurious":12,"sr":4,"ss":0,"ssl":[0,2,4,12],"ssl_cert_path":0,"stabl":4,"stack":[4,7,12],"stale":0,"standard":[0,5,6,10],"start":[0,2,4,7,9,11,12],"starttl":[7,12],"startup":[0,4,6,12],"state":0,"static":12,"status":[2,12],"stay":[0,7,12],"stdout":12,"step":[3,4,6,8,12],"still":[0,3,4,8,10,12],"stop":12,"storag":[0,4,12],"store":[2,4,7,9,12],"str":[0,12],"straight":[0,12],"stream":12,"string":[0,4,7,12],"strip":[0,3,8,12],"strip_attachment_payload":[0,12],"strong":12,"structur":5,"sts":[7,10,12],"stsv1":10,"style":0,"subdomain":[0,3,12],"subfield":4,"subfold":[0,12],"subject":[0,3,8,10,12],"subject_prefix":[3,8],"submiss":0,"submit":[0,4],"subsidiari":7,"substitut":6,"success":[0,12],"successful_sess":7,"successful_session_count":10,"sudo":[2,4,6,12],"suffici":12,"suffix":[0,4],"suggest":7,"suit":12,"suitabl":0,"sum":7,"summari":[3,8,12],"supervis":12,"suppli":[0,7,12],"support":[2,4,5,7,10,11],"sure":4,"surfac":[7,12],"sw50zxjha3rpdmugv2v0dgjld2vyymvylcocymvyc2ljahq":10,"swallow":12,"switch":7,"syslog":[2,5,12],"system":[2,3,4,6,8,12],"systemctl":[2,4,12],"systemd":5,"systemdr":6,"t":[0,4,5,7,8,10,12],"tab":[3,4,8],"tabl":[4,5,7,12],"tag":6,"take":[0,12],"talk":[0,4],"target":[0,2,4,12],"task":[0,4,6],"tbi":10,"tcp":12,"tee":4,"tell":[0,3,7,8],"templat":[3,8],"temporari":7,"tenant":[4,5],"tenant_id":12,"term":6,"test":[0,10,12],"text":[0,4,10],"thank":10,"therebi":[3,8],"therefor":12,"thing":12,"third":0,"though":7,"thousand":12,"three":[0,7,12],"throughput":12,"tier":12,"time":[0,2,4,6,7,12],"timeout":[0,2,12],"timeoutstopsec":12,"timer":12,"timespan":0,"timespan_requires_norm":10,"timestamp":[0,12],"timestamp_to_datetim":0,"timestamp_to_human":0,"timezon":10,"tld":3,"tls":[0,4,5,12],"to_domain":10,"to_utc":0,"togeth":[7,12],"token":[0,4,12],"token_fil":12,"tool":12,"top":[3,7,12],"topic":12,"total":7,"touch":[0,3,8],"toward":0,"tracker":1,"trade":12,"tradit":[3,8],"traffic":7,"trail":12,"transfer":10,"transient":[0,12],"transpar":5,"transport":[4,12],"trash":12,"treat":[0,12],"treatment":0,"tri":[0,12],"troubleshoot":12,"true":[0,2,4,10,12],"trust":12,"truststor":4,"truth":7,"tsvb":7,"tuesday":6,"tune":5,"two":[0,6,7,12],"txt":[0,12],"typ":4,"type":[4,5,7,10,12],"typic":12,"typo":12,"u":[2,6,12],"ubuntu":[4,6],"udp":[0,12],"ui":[3,8],"unaffect":12,"unavail":12,"unchang":[0,12],"uncondit":[3,8,12],"underlying":[0,12],"underneath":7,"underscor":12,"understand":[5,7],"unencrypt":12,"unexpir":12,"unfortun":[3,8],"unit":[0,2,12],"unix":0,"unknown":0,"unless":[6,12],"unlik":0,"unpars":[0,12],"unpickl":0,"unprefix":[4,12],"unreach":12,"unread":12,"unrel":6,"unsav":[0,12],"unsubscrib":[3,8],"unsuffix":4,"unsuit":12,"unus":0,"unzip":2,"updat":[0,4,6,12],"update_by_queri":0,"upersecur":12,"upgrad":[2,5,6,12],"upload":12,"upper":7,"uppercas":12,"uri":[6,12],"url":[0,2,4,12],"us":[10,12],"usabl":12,"usag":12,"use":[0,3,4,5,8,10],"use_ssl":0,"user":[0,2,3,4,6,7,8,10,12],"user_ag":10,"useradd":[2,6],"usernam":[0,12],"usernamepassword":12,"usesystemproxi":2,"usr":[4,6],"usual":12,"utc":[0,12],"utf":10,"util":5,"v":12,"v2":0,"valid":[0,7,10,12],"valimail":5,"valu":[0,3,4,7,8,12],"valueerror":0,"var":[3,8,12],"variabl":5,"variant":[0,12],"various":6,"vendor":3,"venv":[6,12],"verbatim":12,"verbos":12,"veri":[4,7,12],"verif":[0,4,12],"verifi":0,"verification_mod":4,"version":[0,2,4,5,9,10,11,12],"vew":2,"via":[0,2],"view":[7,12],"vim":4,"virtualenv":6,"visual":[4,7,9],"volum":[7,12],"vulner":3,"w":[0,12],"w3c":10,"wait":[0,12],"wait_for_complet":[0,4],"wall":0,"want":[2,12],"wantedbi":[2,12],"warm":0,"warn":[0,4,12],"watch":[0,2,4,6,12],"watch_inbox":[0,12],"watcher":[0,12],"way":[0,4,7,12],"web":[2,4],"webdav":2,"webhook":[5,12],"webmail":[3,7,8],"week":[0,6,12],"well":[2,7,12],"wettbewerb":10,"wget":4,"whalensolut":12,"whatev":[0,12],"wheel":12,"whenev":[0,2,12],"wherea":7,"wherev":12,"whether":[0,12],"whi":[3,7,12],"whole":[0,7,12],"whose":[0,12],"wide":[6,10,12],"widen":4,"wider":12,"wiki":10,"will":[0,2,3,4,6,7,8,12],"win":12,"window":[6,12],"within":[0,12],"without":[3,4,6,7,8],"won":5,"work":[2,3,4,5,6,7,8,12],"worker":[0,12],"workstat":2,"worst":[3,12],"worth":12,"wrap":[3,8],"wrapper":12,"write":[0,4,12],"written":12,"www":[4,6,12],"x":[4,7,10],"x509":4,"xennn":10,"xml":[0,11,12],"xml_schema":10,"xms4g":4,"xmx4g":4,"xpack":4,"xxxx":4,"y":[4,6],"yahoo":7,"yaml":12,"year":12,"yes":[3,8],"yet":[0,3,4,12],"yml":4,"yyyi":[0,12],"z":12,"zero":12,"zip":[0,2,5,12],"\u00fcbersicht":10},"titles":["API reference","Contributing to parsedmarc","Accessing an inbox using OWA/EWS","Understanding DMARC","Elasticsearch and Kibana","parsedmarc documentation - Open source DMARC report analyzer and visualizer","Installation","Using the Kibana dashboards","What about mailing lists?","OpenSearch and Grafana","Sample outputs","Splunk","Using parsedmarc"],"titleterms":{"Do":[3,8],"What":[3,8],"_file":12,"access":2,"aggreg":[7,10],"align":3,"analyz":[5,6],"api":0,"archiv":12,"backfil":4,"best":[3,8],"bug":1,"cli":12,"combin":4,"compat":5,"compos":12,"config":[0,12],"configur":[2,12],"content":5,"contribut":1,"countri":6,"csv":10,"dashboard":7,"databas":6,"davmail":2,"depend":6,"dkim":[3,4],"dmarc":[3,5,7],"docker":12,"document":5,"domain":3,"elast":0,"elasticsearch":4,"env":12,"environ":12,"ew":2,"exampl":12,"exchang":6,"failur":[7,10],"featur":5,"field":4,"file":12,"geolite2":6,"grafana":9,"guid":3,"help":12,"inbox":2,"index":4,"indic":0,"instal":[4,6,9],"ip":6,"json":10,"kibana":[4,7],"librari":12,"list":[3,8],"listserv":[3,8],"lookalik":3,"mail":[3,8],"mailbox":12,"mailman":[3,8],"map":12,"maxmind":6,"messag":12,"microsoft":6,"mode":12,"multi":12,"multipl":6,"name":12,"onc":12,"onli":12,"open":5,"opensearch":[0,9],"option":6,"output":10,"owa":2,"parsedmarc":[0,1,2,5,6,12],"pattern":4,"perform":12,"practic":[3,8],"prerequisit":6,"proxi":6,"python":5,"record":[3,4,9],"refer":0,"reload":12,"report":[1,5,6,7,10,12],"resourc":3,"restart":12,"result":4,"retent":[4,9],"run":[2,12],"sampl":10,"save":12,"secret":12,"section":12,"sender":3,"servic":[2,12],"smtp":[7,10],"sourc":5,"specifi":12,"spf":[3,4],"splunk":[0,11],"suffix":12,"support":[3,12],"systemd":[2,12],"t":3,"tabl":0,"tenant":12,"test":6,"tls":[7,10],"tune":12,"type":0,"understand":3,"upgrad":4,"use":[2,6,7,12],"util":0,"valid":3,"variabl":12,"via":12,"visual":5,"web":6,"without":12,"won":3,"workaround":[3,8]}}) \ No newline at end of file diff --git a/splunk.html b/splunk.html index 538df72f..245fd002 100644 --- a/splunk.html +++ b/splunk.html @@ -6,14 +6,14 @@ - Splunk — parsedmarc 10.4.0 documentation + Splunk — parsedmarc 10.4.1 documentation - + diff --git a/usage.html b/usage.html index 12f77dfe..deb57e88 100644 --- a/usage.html +++ b/usage.html @@ -6,14 +6,14 @@ - Using parsedmarc — parsedmarc 10.4.0 documentation + Using parsedmarc — parsedmarc 10.4.1 documentation - + @@ -230,7 +230,8 @@ Elasticsearch, Splunk and/or S3

    Elasticsearch, Splunk and/or S3

  • save_smtp_tls - bool: Save SMTP-STS report data to Elasticsearch, Splunk and/or S3

    • -

  • index_prefix_domain_map - bool: A path mapping of Opensearch/Elasticsearch index prefixes to domain names

    • +

  • index_prefix_domain_map - str: Path to a YAML file mapping +OpenSearch/Elasticsearch index prefixes to domain names

  • strip_attachment_payloads - bool: Remove attachment payloads from results

  • silent - bool: Set this to False to output results to STDOUT

    • @@ -1377,11 +1378,13 @@ high-volume mailbox processing.

    Save it to disk where the user running ParseDMARC can read it, then set index_prefix_domain_map to that filepath in the [general] section of the ParseDMARC configuration file and do not set an index_prefix option in the [elasticsearch] or [opensearch] sections.

    -

    When configured correctly, if ParseDMARC finds that a report is related to a domain in the mapping, the report will be saved in an index name that has the tenant name prefixed to it with a trailing underscore. Then, you can use the security features of Opensearch or the ELK stack to only grant users access to the indexes that they need.

    +

    When configured correctly, if ParseDMARC finds that a report is related to a domain in the mapping, the report will be saved in an index name that has the tenant name prefixed to it with a trailing underscore. Then, you can use the security features of OpenSearch or the ELK stack to only grant users access to the indexes that they need.

    Note

    A domain cannot be used in multiple tenant lists. Only the first prefix list that contains the matching domain is used.

    +

    Each key must be a tenant name and each value a list of domain names, all strings; a file of any other shape is rejected at startup.

    +

    The index migrations and backfills that run at startup cover every tenant prefix in the map, in addition to the unprefixed indexes that hold reports for domains the map does not list. A configuration reload (SIGHUP) re-reads the map, so a newly onboarded tenant is covered without restarting parsedmarc. See Backfilling the combined DKIM/SPF result fields for the details.

    Running parsedmarc as a systemd service