diff --git a/parsedmarc/__init__.py b/parsedmarc/__init__.py index 7067159..0d32f5f 100644 --- a/parsedmarc/__init__.py +++ b/parsedmarc/__init__.py @@ -628,7 +628,7 @@ def parse_aggregate_report_xml( nameservers: bool = None, timeout: float = 2.0, keep_alive: callable = None, - normalize_timespan_threshold_hours: float = 24.0 + normalize_timespan_threshold_hours: float = 24.0, ): """Parses a DMARC XML report string and returns a consistent OrderedDict @@ -905,8 +905,7 @@ def parse_aggregate_report_file( nameservers: list[str] = None, dns_timeout: float = 2.0, keep_alive: Callable = None, - normalize_timespan_threshold_hours: float = 24.0 - + normalize_timespan_threshold_hours: float = 24.0, ): """Parses a file at the given path, a file-like object. or bytes as an aggregate DMARC report @@ -976,7 +975,9 @@ def parsed_aggregate_reports_to_csv_rows(reports: list[dict]): report_id = report["report_metadata"]["report_id"] begin_date = report["report_metadata"]["begin_date"] end_date = report["report_metadata"]["end_date"] - normalized_timespan = report["report_metadata"]["timespan_requires_normalization"] + normalized_timespan = report["report_metadata"][ + "timespan_requires_normalization" + ] errors = "|".join(report["report_metadata"]["errors"]) domain = report["policy_published"]["domain"] adkim = report["policy_published"]["adkim"] @@ -1374,7 +1375,7 @@ def parse_report_email( dns_timeout: float = 2.0, strip_attachment_payloads: bool = False, keep_alive: callable = None, - normalize_timespan_threshold_hours: float = 24.0 + normalize_timespan_threshold_hours: float = 24.0, ): """ Parses a DMARC report from an email @@ -1649,7 +1650,7 @@ def get_dmarc_reports_from_mbox( reverse_dns_map_path: str = None, reverse_dns_map_url: str = None, offline: bool = False, - normalize_timespan_threshold_hours: float = 24.0 + normalize_timespan_threshold_hours: float = 24.0, ): """Parses a mailbox in mbox format containing e-mails with attached DMARC reports @@ -1696,7 +1697,7 @@ def get_dmarc_reports_from_mbox( nameservers=nameservers, dns_timeout=dns_timeout, strip_attachment_payloads=sa, - normalize_timespan_threshold_hours=normalize_timespan_threshold_hours + normalize_timespan_threshold_hours=normalize_timespan_threshold_hours, ) if parsed_email["report_type"] == "aggregate": report_org = parsed_email["report"]["report_metadata"]["org_name"] @@ -1745,8 +1746,7 @@ def get_dmarc_reports_from_mailbox( batch_size: int = 10, since: datetime = None, create_folders: bool = True, - normalize_timespan_threshold_hours: float = 24 - + normalize_timespan_threshold_hours: float = 24, ): """ Fetches and parses DMARC reports from a mailbox @@ -2043,7 +2043,7 @@ def get_dmarc_reports_from_mailbox( reverse_dns_map_url=reverse_dns_map_url, offline=offline, since=current_time, - normalize_timespan_threshold_hours=normalize_timespan_threshold_hours + normalize_timespan_threshold_hours=normalize_timespan_threshold_hours, ) return results @@ -2066,7 +2066,7 @@ def watch_inbox( dns_timeout: float = 6.0, strip_attachment_payloads: bool = False, batch_size: int = None, - normalize_timespan_threshold_hours: float = 24 + normalize_timespan_threshold_hours: float = 24, ): """ Watches the mailbox for new messages and @@ -2113,7 +2113,7 @@ def watch_inbox( strip_attachment_payloads=sa, batch_size=batch_size, create_folders=False, - normalize_timespan_threshold_hours=normalize_timespan_threshold_hours + normalize_timespan_threshold_hours=normalize_timespan_threshold_hours, ) callback(res) diff --git a/parsedmarc/cli.py b/parsedmarc/cli.py index 55c2c7f..208fde2 100644 --- a/parsedmarc/cli.py +++ b/parsedmarc/cli.py @@ -678,7 +678,9 @@ def _main(): opts.silent = False normalize_timespan_threshold_hours = 24.0 if "normalize_timespan_threshold_hours" in general_config: - normalize_timespan_threshold_hours = general_config.getfloat("normalize_timespan_threshold_hours") + normalize_timespan_threshold_hours = general_config.getfloat( + "normalize_timespan_threshold_hours" + ) if "index_prefix_domain_map" in general_config: with open(general_config["index_prefix_domain_map"]) as f: index_prefix_domain_map = yaml.safe_load(f) @@ -1498,7 +1500,7 @@ def _main(): reverse_dns_map_path=opts.reverse_dns_map_path, reverse_dns_map_url=opts.reverse_dns_map_url, offline=opts.offline, - normalize_timespan_threshold_hours=normalize_timespan_threshold_hours + normalize_timespan_threshold_hours=normalize_timespan_threshold_hours, ) aggregate_reports += reports["aggregate_reports"] forensic_reports += reports["forensic_reports"] diff --git a/parsedmarc/splunk.py b/parsedmarc/splunk.py index 7edf1b5..18307d5 100644 --- a/parsedmarc/splunk.py +++ b/parsedmarc/splunk.py @@ -79,8 +79,8 @@ class HECClient(object): for metadata in report["report_metadata"]: new_report[metadata] = report["report_metadata"][metadata] new_report["interval_begin"] = record["interval_begin"] - new_report["interval_end"] = record["interval_end"] - new_report["normalized_timespan"] = record["normalized_timespan"] + new_report["interval_end"] = record["interval_end"] + new_report["normalized_timespan"] = record["normalized_timespan"] new_report["published_policy"] = report["policy_published"] new_report["source_ip_address"] = record["source"]["ip_address"] new_report["source_country"] = record["source"]["country"] @@ -101,7 +101,9 @@ class HECClient(object): new_report["spf_results"] = record["auth_results"]["spf"] data["sourcetype"] = "dmarc:aggregate" - timestamp = human_timestamp_to_unix_timestamp(new_report["interval_begin"]) + timestamp = human_timestamp_to_unix_timestamp( + new_report["interval_begin"] + ) data["time"] = timestamp data["event"] = new_report.copy() json_str += "{0}\n".format(json.dumps(data))