diff --git a/_modules/index.html b/_modules/index.html index 51a534f..85828df 100644 --- a/_modules/index.html +++ b/_modules/index.html @@ -8,7 +8,7 @@ - Overview: module code — parsedmarc 2.1.2 documentation + Overview: module code — parsedmarc 3.0.0 documentation @@ -35,7 +35,7 @@ - + @@ -64,7 +64,7 @@
- 2.1.2 + 3.0.0
@@ -187,7 +187,7 @@ @@ -65,7 +65,7 @@
- 2.1.2 + 3.0.0
@@ -293,7 +293,7 @@ @@ -64,7 +64,7 @@
- 2.1.2 + 3.0.0
@@ -186,31 +186,34 @@
  • Consistent data structures
  • Simple JSON and/or CSV output
  • Optionally email the results
    • +
  • Optionally send the results to Elasticsearch, for use with premade Kibana dashboards

    • CLI help

    usage: parsedmarc [-h] [-o OUTPUT] [-n NAMESERVERS [NAMESERVERS ...]]
-                  [-t TIMEOUT] [-H HOST] [-u USER] [-p PASSWORD]
-                  [-a ARCHIVE_FOLDER] [-d] [-O OUTGOING_HOST]
-                  [-U OUTGOING_USER] [-P OUTGOING_PASSWORD]
-                  [-F OUTGOING_FROM] [-T OUTGOING_TO [OUTGOING_TO ...]]
-                  [-S OUTGOING_SUBJECT] [-A OUTGOING_ATTACHMENT]
-                  [-M OUTGOING_MESSAGE] [-i] [--test] [-v]
-                  [file_path [file_path ...]]
+              [-t TIMEOUT] [-H HOST] [-u USER] [-p PASSWORD]
+              [-r REPORTS_FOLDER] [-a ARCHIVE_FOLDER] [-d]
+              [-E [ELASTICSEARCH_HOST [ELASTICSEARCH_HOST ...]]]
+              [--save-aggregate] [--save-forensic] [-O OUTGOING_HOST]
+              [-U OUTGOING_USER] [-P OUTGOING_PASSWORD] [-F OUTGOING_FROM]
+              [-T OUTGOING_TO [OUTGOING_TO ...]] [-S OUTGOING_SUBJECT]
+              [-A OUTGOING_ATTACHMENT] [-M OUTGOING_MESSAGE] [-i] [--test]
+              [-v]
+              [file_path [file_path ...]]
 
 Parses DMARC reports
 
 positional arguments:
-  file_path             one or more paths of aggregate report files
-                        (compressed or uncompressed)
+  file_path             one or more paths to aggregate or forensic report
+                        files or emails
 
 optional arguments:
   -h, --help            show this help message and exit
   -o OUTPUT, --output OUTPUT
                         Write output files to the given directory
   -n NAMESERVERS [NAMESERVERS ...], --nameservers NAMESERVERS [NAMESERVERS ...]
-                        nameservers to query
+                        nameservers to query (Default 8.8.8.8 4.4.4.4)
   -t TIMEOUT, --timeout TIMEOUT
                         number of seconds to wait for an answer from DNS
                         (default 6.0)
@@ -218,10 +221,17 @@
   -u USER, --user USER  IMAP user
   -p PASSWORD, --password PASSWORD
                         IMAP password
+  -r REPORTS_FOLDER, --reports-folder REPORTS_FOLDER
+                        The IMAP folder containing the reports Default: INBOX
   -a ARCHIVE_FOLDER, --archive-folder ARCHIVE_FOLDER
                         Specifies the IMAP folder to move messages to after
-                        processing them (default: Archive)
+                        processing them Default: Archive
   -d, --delete          Delete the reports after processing them
+  -E [ELASTICSEARCH_HOST [ELASTICSEARCH_HOST ...]], --elasticsearch-host [ELASTICSEARCH_HOST [ELASTICSEARCH_HOST ...]]
+                        A list of one or more Elasticsearch hostnames or URLs
+                        to use (Default localhost:9200)
+  --save-aggregate      Save aggregate reports to Elasticsearch
+  --save-forensic       Save forensic reports to Elasticsearch
   -O OUTGOING_HOST, --outgoing-host OUTGOING_HOST
                         Email the results using this host
   -U OUTGOING_USER, --outgoing-user OUTGOING_USER
@@ -343,7 +353,7 @@ forensic report that you can share publicly, please contact me!

    Installation

    -

    parsedmarc works with Python 2 or 3, but Python 3 is preferred.

    +

    parsedmarc works with Python 3 only.

    On Debian or Ubuntu systems, run:

    $ sudo apt-get install python3-pip
    @@ -377,7 +387,7 @@ above commands.

    API

    -

    A Python module and CLI for parsing DMARC reports

    +

    A Python module for parsing DMARC reports

    exception parsedmarc.IMAPError[source]
    @@ -464,7 +474,7 @@ or bytes.

    -parsedmarc.get_dmarc_reports_from_inbox(host, user, password, archive_folder='Archive', delete=False, test=False, nameservers=None, dns_timeout=6.0)[source]
    +parsedmarc.get_dmarc_reports_from_inbox(host, user, password, reports_folder='INBOX', archive_folder='Archive', delete=False, test=False, nameservers=None, dns_timeout=6.0)[source]

    Fetches and parses DMARC reports from sn inbox

    @@ -474,6 +484,7 @@ or bytes.

  • host – The mail server hostname or IP address
  • user – The mail server user
  • password – The mail server password
    • +
  • reports_folder – The IMAP folder where reports can be found
  • archive_folder – The folder to move processed mail to
  • delete (bool) – Delete messages after processing them
  • test (bool) – Do not move or delete messages after processing them
    • @@ -540,6 +551,7 @@ aggregate DMARC report

    @@ -565,6 +577,7 @@ aggregate DMARC report

    @@ -588,10 +601,11 @@ aggregate DMARC report

    @@ -647,6 +661,7 @@ file-like object. or bytes

    @@ -719,7 +734,7 @@ headers

    -parsedmarc.watch_inbox(host, username, password, callback, archive_folder='Archive', delete=False, test=False, wait=30, nameservers=None, dns_timeout=6.0)[source]
    +parsedmarc.watch_inbox(host, username, password, callback, reports_folder='INBOX', archive_folder='Archive', delete=False, test=False, wait=30, nameservers=None, dns_timeout=6.0)[source]

    Use an IDLE IMAP connection to parse incoming emails, and pass the results to a callback function

    Parameters:
    • _input – A path to a file, a file like object, or bytes
    • nameservers (list) – A list of one or more nameservers to use
      • +
    • and 4.4.4.4 by default) ((8.8.8.8) –
    • timeout (float) – Sets the DNS timeout in seconds
    Parameters:
    • xml (str) – A string of DMARC aggregate report XML
    • nameservers (list) – A list of one or more nameservers to use
      • +
    • and 4.4.4.4 by default) ((8.8.8.8) –
    • timeout (float) – Sets the DNS timeout in seconds
    Parameters:
      -
    • feedback_report – A message’s feedback report as a string
      • -
    • sample – The RFC 822 headers or RFC 822 message sample
      • +
    • feedback_report (str) – A message’s feedback report as a string
      • +
    • sample (str) – The RFC 822 headers or RFC 822 message sample
    • sample_headers_only (bool) – Set true if the sample is only headers
    • nameservers (list) – A list of one or more nameservers to use
      • +
    • and 4.4.4.4 by default) ((8.8.8.8) –
    • timeout (float) – Sets the DNS timeout in seconds
    Parameters:
    • input – A path to a file, a file like object, or bytes
    • nameservers (list) – A list of one or more nameservers to use
      • +
    • and 4.4.4.4 by default) ((8.8.8.8) –
    • timeout (float) – Sets the DNS timeout in seconds
    @@ -731,11 +746,13 @@ to a callback function

  • username – The mail server username
  • password – The mail server password
  • callback – The callback function to receive the parsing results
    • +
  • reports_folder – The IMAP folder where reports can be found
  • archive_folder – The folder to move processed mail to
  • delete (bool) – Delete messages after processing them
  • test (bool) – Do not move or delete messages after processing them
  • wait (int) – Number of seconds to wait for a IMAP IDLE response
    • -
  • nameservers (list) – A list of DNS nameservers to query
    • +
  • nameservers (list) – A list of one or more nameservers to use
    • +
  • and 4.4.4.4 by default) ((8.8.8.8) –
  • dns_timeout (float) – Set the DNS query timeout
    • @@ -792,7 +809,7 @@ to a callback function

    @@ -64,7 +64,7 @@
    - 2.1.2 + 3.0.0
    @@ -195,7 +195,7 @@