From 5a432418895411dde15d3186b935c1f0ea1affc4 Mon Sep 17 00:00:00 2001
From: Sean Whalen <whalenster@gmail.com>
Date: Sat, 29 Sep 2018 14:00:26 -0400
Subject: [PATCH] 4.1.1

---
 _modules/index.html              |   6 +-
 _modules/parsedmarc.html         |  46 ++++++--
 _modules/parsedmarc/elastic.html |   6 +-
 _sources/index.rst.txt           | 191 +++++++++++++++++++------------
 _static/documentation_options.js |   2 +-
 genindex.html                    |   6 +-
 index.html                       | 187 ++++++++++++++++++------------
 objects.inv                      | Bin 560 -> 559 bytes
 py-modindex.html                 |   6 +-
 search.html                      |   6 +-
 searchindex.js                   |   2 +-
 11 files changed, 283 insertions(+), 175 deletions(-)

diff --git a/_modules/index.html b/_modules/index.html
index 2b688f8..f31cdad 100644
--- a/_modules/index.html
+++ b/_modules/index.html
@@ -8,7 +8,7 @@
   
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   
-  <title>Overview: module code &mdash; parsedmarc 4.1.0 documentation</title>
+  <title>Overview: module code &mdash; parsedmarc 4.1. documentation</title>
   
 
   
@@ -56,7 +56,7 @@
             
             
               <div class="version">
-                4.1.0
+                4.1.
               </div>
             
           
@@ -177,7 +177,7 @@
     <script type="text/javascript">
         var DOCUMENTATION_OPTIONS = {
             URL_ROOT:'../',
-            VERSION:'4.1.0',
+            VERSION:'4.1.',
             LANGUAGE:'None',
             COLLAPSE_INDEX:false,
             FILE_SUFFIX:'.html',
diff --git a/_modules/parsedmarc.html b/_modules/parsedmarc.html
index f88fc64..94b34c8 100644
--- a/_modules/parsedmarc.html
+++ b/_modules/parsedmarc.html
@@ -8,7 +8,7 @@
   
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   
-  <title>parsedmarc &mdash; parsedmarc 4.1.0 documentation</title>
+  <title>parsedmarc &mdash; parsedmarc 4.1. documentation</title>
   
 
   
@@ -56,7 +56,7 @@
             
             
               <div class="version">
-                4.1.0
+                4.1.
               </div>
             
           
@@ -189,10 +189,10 @@
 <span class="kn">import</span> <span class="nn">dateparser</span>
 <span class="kn">import</span> <span class="nn">mailparser</span>
 
-<span class="n">__version__</span> <span class="o">=</span> <span class="s2">&quot;4.1.0&quot;</span>
+<span class="n">__version__</span> <span class="o">=</span> <span class="s2">&quot;4.1.&quot;</span>
 
 <span class="n">logger</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="vm">__name__</span><span class="p">)</span>
-<span class="n">logger</span><span class="o">.</span><span class="n">setLevel</span><span class="p">(</span><span class="n">logging</span><span class="o">.</span><span class="n">INFO</span><span class="p">)</span>
+<span class="n">logger</span><span class="o">.</span><span class="n">setLevel</span><span class="p">(</span><span class="n">logging</span><span class="o">.</span><span class="n">ERROR</span><span class="p">)</span>
 
 <span class="n">feedback_report_regex</span> <span class="o">=</span> <span class="n">re</span><span class="o">.</span><span class="n">compile</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;^([\w\-]+): (.+)$&quot;</span><span class="p">,</span> <span class="n">re</span><span class="o">.</span><span class="n">MULTILINE</span><span class="p">)</span>
 
@@ -1673,7 +1673,7 @@
     <span class="k">except</span> <span class="n">imapclient</span><span class="o">.</span><span class="n">exceptions</span><span class="o">.</span><span class="n">IMAPClientError</span> <span class="k">as</span> <span class="n">error</span><span class="p">:</span>
         <span class="n">error</span> <span class="o">=</span> <span class="n">error</span><span class="o">.</span><span class="fm">__str__</span><span class="p">()</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s2">&quot;b&#39;&quot;</span><span class="p">,</span> <span class="s2">&quot;&quot;</span><span class="p">)</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s2">&quot;&#39;&quot;</span><span class="p">,</span> <span class="s2">&quot;&quot;</span><span class="p">)</span>
         <span class="c1"># Workaround for random Exchange/Office365 IMAP errors</span>
-        <span class="k">if</span> <span class="s2">&quot;Server Unavailable. 15&quot;</span> <span class="ow">in</span> <span class="n">error</span><span class="p">:</span>
+        <span class="k">if</span> <span class="s2">&quot;Server Unavailable. 15&quot;</span> <span class="ow">in</span> <span class="n">error</span> <span class="ow">or</span> <span class="s2">&quot;BAD&quot;</span> <span class="ow">in</span> <span class="n">error</span><span class="p">:</span>
             <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;IMAP error: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">error</span><span class="p">))</span>
             <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;Reconnecting watcher&quot;</span><span class="p">)</span>
             <span class="n">server</span> <span class="o">=</span> <span class="n">imapclient</span><span class="o">.</span><span class="n">IMAPClient</span><span class="p">(</span><span class="n">host</span><span class="p">)</span>
@@ -1698,7 +1698,23 @@
     <span class="k">except</span> <span class="ne">ConnectionRefusedError</span><span class="p">:</span>
         <span class="k">raise</span> <span class="n">IMAPError</span><span class="p">(</span><span class="s2">&quot;Connection refused&quot;</span><span class="p">)</span>
     <span class="k">except</span> <span class="ne">ConnectionResetError</span><span class="p">:</span>
-        <span class="k">raise</span> <span class="n">IMAPError</span><span class="p">(</span><span class="s2">&quot;Connection reset&quot;</span><span class="p">)</span>
+        <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;IMAP error: Connection reset&quot;</span><span class="p">)</span>
+        <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;Reconnecting watcher&quot;</span><span class="p">)</span>
+        <span class="n">server</span> <span class="o">=</span> <span class="n">imapclient</span><span class="o">.</span><span class="n">IMAPClient</span><span class="p">(</span><span class="n">host</span><span class="p">)</span>
+        <span class="n">server</span><span class="o">.</span><span class="n">login</span><span class="p">(</span><span class="n">username</span><span class="p">,</span> <span class="n">password</span><span class="p">)</span>
+        <span class="n">server</span><span class="o">.</span><span class="n">select_folder</span><span class="p">(</span><span class="n">rf</span><span class="p">)</span>
+        <span class="n">idle_start_time</span> <span class="o">=</span> <span class="n">time</span><span class="o">.</span><span class="n">monotonic</span><span class="p">()</span>
+        <span class="n">ms</span> <span class="o">=</span> <span class="s2">&quot;MOVE&quot;</span> <span class="ow">in</span> <span class="n">get_imap_capabilities</span><span class="p">(</span><span class="n">server</span><span class="p">)</span>
+        <span class="n">res</span> <span class="o">=</span> <span class="n">get_dmarc_reports_from_inbox</span><span class="p">(</span><span class="n">connection</span><span class="o">=</span><span class="n">server</span><span class="p">,</span>
+                                           <span class="n">move_supported</span><span class="o">=</span><span class="n">ms</span><span class="p">,</span>
+                                           <span class="n">reports_folder</span><span class="o">=</span><span class="n">rf</span><span class="p">,</span>
+                                           <span class="n">archive_folder</span><span class="o">=</span><span class="n">af</span><span class="p">,</span>
+                                           <span class="n">delete</span><span class="o">=</span><span class="n">delete</span><span class="p">,</span>
+                                           <span class="n">test</span><span class="o">=</span><span class="n">test</span><span class="p">,</span>
+                                           <span class="n">nameservers</span><span class="o">=</span><span class="n">ns</span><span class="p">,</span>
+                                           <span class="n">dns_timeout</span><span class="o">=</span><span class="n">dt</span><span class="p">)</span>
+        <span class="n">callback</span><span class="p">(</span><span class="n">res</span><span class="p">)</span>
+        <span class="n">server</span><span class="o">.</span><span class="n">idle</span><span class="p">()</span>
     <span class="k">except</span> <span class="ne">ConnectionAbortedError</span><span class="p">:</span>
         <span class="k">raise</span> <span class="n">IMAPError</span><span class="p">(</span><span class="s2">&quot;Connection aborted&quot;</span><span class="p">)</span>
     <span class="k">except</span> <span class="ne">TimeoutError</span><span class="p">:</span>
@@ -1759,7 +1775,21 @@
         <span class="k">except</span> <span class="ne">ConnectionRefusedError</span><span class="p">:</span>
             <span class="k">raise</span> <span class="n">IMAPError</span><span class="p">(</span><span class="s2">&quot;Connection refused&quot;</span><span class="p">)</span>
         <span class="k">except</span> <span class="ne">ConnectionResetError</span><span class="p">:</span>
-            <span class="k">raise</span> <span class="n">IMAPError</span><span class="p">(</span><span class="s2">&quot;Connection reset&quot;</span><span class="p">)</span>
+            <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;IMAP error: Connection reset&quot;</span><span class="p">)</span>
+            <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;Reconnecting watcher&quot;</span><span class="p">)</span>
+            <span class="n">server</span> <span class="o">=</span> <span class="n">imapclient</span><span class="o">.</span><span class="n">IMAPClient</span><span class="p">(</span><span class="n">host</span><span class="p">)</span>
+            <span class="n">server</span><span class="o">.</span><span class="n">login</span><span class="p">(</span><span class="n">username</span><span class="p">,</span> <span class="n">password</span><span class="p">)</span>
+            <span class="n">server</span><span class="o">.</span><span class="n">select_folder</span><span class="p">(</span><span class="n">rf</span><span class="p">)</span>
+            <span class="n">idle_start_time</span> <span class="o">=</span> <span class="n">time</span><span class="o">.</span><span class="n">monotonic</span><span class="p">()</span>
+            <span class="n">ms</span> <span class="o">=</span> <span class="s2">&quot;MOVE&quot;</span> <span class="ow">in</span> <span class="n">get_imap_capabilities</span><span class="p">(</span><span class="n">server</span><span class="p">)</span>
+            <span class="n">res</span> <span class="o">=</span> <span class="n">get_dmarc_reports_from_inbox</span><span class="p">(</span><span class="n">connection</span><span class="o">=</span><span class="n">server</span><span class="p">,</span>
+                                               <span class="n">move_supported</span><span class="o">=</span><span class="n">ms</span><span class="p">,</span>
+                                               <span class="n">reports_folder</span><span class="o">=</span><span class="n">rf</span><span class="p">,</span>
+                                               <span class="n">archive_folder</span><span class="o">=</span><span class="n">af</span><span class="p">,</span>
+                                               <span class="n">delete</span><span class="o">=</span><span class="n">delete</span><span class="p">,</span>
+                                               <span class="n">test</span><span class="o">=</span><span class="n">test</span><span class="p">,</span>
+                                               <span class="n">nameservers</span><span class="o">=</span><span class="n">ns</span><span class="p">,</span>
+                                               <span class="n">dns_timeout</span><span class="o">=</span><span class="n">dt</span><span class="p">)</span>
         <span class="k">except</span> <span class="ne">ConnectionAbortedError</span><span class="p">:</span>
             <span class="k">raise</span> <span class="n">IMAPError</span><span class="p">(</span><span class="s2">&quot;Connection aborted&quot;</span><span class="p">)</span>
         <span class="k">except</span> <span class="ne">TimeoutError</span><span class="p">:</span>
@@ -1827,7 +1857,7 @@
     <script type="text/javascript">
         var DOCUMENTATION_OPTIONS = {
             URL_ROOT:'../',
-            VERSION:'4.1.0',
+            VERSION:'4.1.',
             LANGUAGE:'None',
             COLLAPSE_INDEX:false,
             FILE_SUFFIX:'.html',
diff --git a/_modules/parsedmarc/elastic.html b/_modules/parsedmarc/elastic.html
index 6ef24b5..de92e7b 100644
--- a/_modules/parsedmarc/elastic.html
+++ b/_modules/parsedmarc/elastic.html
@@ -8,7 +8,7 @@
   
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   
-  <title>parsedmarc.elastic &mdash; parsedmarc 4.1.0 documentation</title>
+  <title>parsedmarc.elastic &mdash; parsedmarc 4.1. documentation</title>
   
 
   
@@ -56,7 +56,7 @@
             
             
               <div class="version">
-                4.1.0
+                4.1.
               </div>
             
           
@@ -561,7 +561,7 @@
     <script type="text/javascript">
         var DOCUMENTATION_OPTIONS = {
             URL_ROOT:'../../',
-            VERSION:'4.1.0',
+            VERSION:'4.1.',
             LANGUAGE:'None',
             COLLAPSE_INDEX:false,
             FILE_SUFFIX:'.html',
diff --git a/_sources/index.rst.txt b/_sources/index.rst.txt
index 2de74fa..1433469 100644
--- a/_sources/index.rst.txt
+++ b/_sources/index.rst.txt
@@ -55,85 +55,84 @@ CLI help
                     [--hec-skip-certificate-verification] [--save-aggregate]
                     [--save-forensic] [-O OUTGOING_HOST] [-U OUTGOING_USER]
                     [-P OUTGOING_PASSWORD] [--outgoing-port OUTGOING_PORT]
-                    [--outgoing-ssl OUTGOING_SSL] [-F OUTG OING_FROM]
+                    [--outgoing-ssl OUTGOING_SSL] [-F OUTGOING_FROM]
                     [-T OUTGOING_TO [OUTGOING_TO ...]] [-S OUTGOING_SUBJECT]
                     [-A OUTGOING_ATTACHMENT] [-M OUTGOING_MESSAGE] [-w] [--test]
                     [-s] [--debug] [-v]
                     [file_path [file_path ...]]
 
-    Parses DMARC reports
+   Parses DMARC reports
 
-    positional arguments:
-      file_path             one or more paths to aggregate or forensic report
-                            files or emails
-
-    optional arguments:
-      -h, --help            show this help message and exit
-      -o OUTPUT, --output OUTPUT
-                            Write output files to the given directory
-      -n NAMESERVERS [NAMESERVERS ...], --nameservers NAMESERVERS [NAMESERVERS ...]
-                            nameservers to query (Default is Cloudflare's)
-      -t TIMEOUT, --timeout TIMEOUT
-                            number of seconds to wait for an answer from DNS
-                            (default 2.0)
-      -H HOST, --host HOST  IMAP hostname or IP address
-      -u USER, --user USER  IMAP user
-      -p PASSWORD, --password PASSWORD
-                            IMAP password
-      -r REPORTS_FOLDER, --reports-folder REPORTS_FOLDER
-                            The IMAP folder containing the reports Default: INBOX
-      -a ARCHIVE_FOLDER, --archive-folder ARCHIVE_FOLDER
-                            Specifies the IMAP folder to move messages to after
-                            processing them Default: Archive
-      -d, --delete          Delete the reports after processing them
-      -E [ELASTICSEARCH_HOST [ELASTICSEARCH_HOST ...]], --elasticsearch-host [ELASTICSEARCH_HOST [ELASTICSEARCH_HOST ...]]
-                            A list of one or more Elasticsearch hostnames or URLs
-                            to use (e.g. localhost:9200)
-      --elasticsearch-index-prefix ELASTICSEARCH_INDEX_PREFIX
-                            Prefix to add in front of the dmarc_aggregate and
-                            dmarc_forensic Elasticsearch index names, joined by _
-      --elasticsearch-index-suffix ELASTICSEARCH_INDEX_SUFFIX
-                            Append this suffix to the dmarc_aggregate and
-                            dmarc_forensic Elasticsearch index names, joined by _
-      --hec HEC             URL to a Splunk HTTP Event Collector (HEC)
-      --hec-token HEC_TOKEN
-                            The authorization token for a Splunk HTTP event
-                            collector (HEC)
-      --hec-index HEC_INDEX
-                            The index to use when sending events to the Splunk
-                            HTTP Events
-      --hec-skip-certificate-verification
-                            Skip certificate verification for Splunk HEC
-      --save-aggregate      Save aggregate reports to search indexes
-      --save-forensic       Save forensic reports to search indexes
-      -O OUTGOING_HOST, --outgoing-host OUTGOING_HOST
-                            Email the results using this host
-      -U OUTGOING_USER, --outgoing-user OUTGOING_USER
-                            Email the results using this user
-      -P OUTGOING_PASSWORD, --outgoing-password OUTGOING_PASSWORD
-                            Email the results using this password
-      --outgoing-port OUTGOING_PORT
-                            Email the results using this port
-      --outgoing-ssl OUTGOING_SSL
-                            Use SSL/TLS instead of STARTTLS (more secure, and
-                            required by some providers, like Gmail)
-      -F OUTGOING_FROM, --outgoing-from OUTGOING_FROM
-                            Email the results using this from address
-      -T OUTGOING_TO [OUTGOING_TO ...], --outgoing-to OUTGOING_TO [OUTGOING_TO ...]
-                            Email the results to these addresses
-      -S OUTGOING_SUBJECT, --outgoing-subject OUTGOING_SUBJECT
-                            Email the results using this subject
-      -A OUTGOING_ATTACHMENT, --outgoing-attachment OUTGOING_ATTACHMENT
-                            Email the results using this filename
-      -M OUTGOING_MESSAGE, --outgoing-message OUTGOING_MESSAGE
-                            Email the results using this message
-      -w, --watch           Use an IMAP IDLE connection to process reports as they
-                            arrive in the inbox
-      --test                Do not move or delete IMAP messages
-      -s, --silent          Only print errors
-      --debug               Print debugging information
-      -v, --version         show program's version number and exit
+   positional arguments:
+     file_path             one or more paths to aggregate or forensic report
+                           files or emails
 
+   optional arguments:
+     -h, --help            show this help message and exit
+     -o OUTPUT, --output OUTPUT
+                           Write output files to the given directory
+     -n NAMESERVERS [NAMESERVERS ...], --nameservers NAMESERVERS [NAMESERVERS ...]
+                           nameservers to query (Default is Cloudflare's)
+     -t TIMEOUT, --timeout TIMEOUT
+                           number of seconds to wait for an answer from DNS
+                           (default 2.0)
+     -H HOST, --host HOST  IMAP hostname or IP address
+     -u USER, --user USER  IMAP user
+     -p PASSWORD, --password PASSWORD
+                           IMAP password
+     -r REPORTS_FOLDER, --reports-folder REPORTS_FOLDER
+                           The IMAP folder containing the reports Default: INBOX
+     -a ARCHIVE_FOLDER, --archive-folder ARCHIVE_FOLDER
+                           Specifies the IMAP folder to move messages to after
+                           processing them Default: Archive
+     -d, --delete          Delete the reports after processing them
+     -E [ELASTICSEARCH_HOST [ELASTICSEARCH_HOST ...]], --elasticsearch-host [ELASTICSEARCH_HOST [ELASTICSEARCH_HOST ...]]
+                           A list of one or more Elasticsearch hostnames or URLs
+                           to use (e.g. localhost:9200)
+     --elasticsearch-index-prefix ELASTICSEARCH_INDEX_PREFIX
+                           Prefix to add in front of the dmarc_aggregate and
+                           dmarc_forensic Elasticsearch index names, joined by _
+     --elasticsearch-index-suffix ELASTICSEARCH_INDEX_SUFFIX
+                           Append this suffix to the dmarc_aggregate and
+                           dmarc_forensic Elasticsearch index names, joined by _
+     --hec HEC             URL to a Splunk HTTP Event Collector (HEC)
+     --hec-token HEC_TOKEN
+                           The authorization token for a Splunk HTTP Event
+                           Collector (HEC)
+     --hec-index HEC_INDEX
+                           The index to use when sending events to the Splunk
+                           HTTP Event Collector (HEC)
+     --hec-skip-certificate-verification
+                           Skip certificate verification for Splunk HEC
+     --save-aggregate      Save aggregate reports to search indexes
+     --save-forensic       Save forensic reports to search indexes
+     -O OUTGOING_HOST, --outgoing-host OUTGOING_HOST
+                           Email the results using this host
+     -U OUTGOING_USER, --outgoing-user OUTGOING_USER
+                           Email the results using this user
+     -P OUTGOING_PASSWORD, --outgoing-password OUTGOING_PASSWORD
+                           Email the results using this password
+     --outgoing-port OUTGOING_PORT
+                           Email the results using this port
+     --outgoing-ssl OUTGOING_SSL
+                           Use SSL/TLS instead of STARTTLS (more secure, and
+                           required by some providers, like Gmail)
+     -F OUTGOING_FROM, --outgoing-from OUTGOING_FROM
+                           Email the results using this from address
+     -T OUTGOING_TO [OUTGOING_TO ...], --outgoing-to OUTGOING_TO [OUTGOING_TO ...]
+                           Email the results to these addresses
+     -S OUTGOING_SUBJECT, --outgoing-subject OUTGOING_SUBJECT
+                           Email the results using this subject
+     -A OUTGOING_ATTACHMENT, --outgoing-attachment OUTGOING_ATTACHMENT
+                           Email the results using this filename
+     -M OUTGOING_MESSAGE, --outgoing-message OUTGOING_MESSAGE
+                           Email the results using this message
+     -w, --watch           Use an IMAP IDLE connection to process reports as they
+                           arrive in the inbox
+     --test                Do not move or delete IMAP messages
+     -s, --silent          Only print errors
+     --debug               Print debugging information
+     -v, --version         show program's version number and exit
 
 SPF and DMARC record validation
 ===============================
@@ -276,7 +275,7 @@ Or, install the latest development release directly from GitHub:
 
 .. note::
 
-    On Windows, ``pip3`` is ``pip``, even with Python 3. So on Windows, simply
+    On Windows, ``pip3`` is ``pip``, even with Python 3. So on Windows,
     substitute ``pip`` as an administrator in place of ``sudo pip3``, in the
     above commands.
 
@@ -365,11 +364,16 @@ Testing multiple report analyzers
 
 If you would like to test parsedmarc and another report processing solution
 at the same time, you can have up to two mailto URIs each in the rua and ruf
-tags tgs in your DMARC record, separated by commas.
+tags in your DMARC record, separated by commas.
 
 Elasticsearch and Kibana
 ------------------------
 
+.. note::
+
+   Splunk is also supported starting with ``parsedmarc`` 4.1.1
+
+
 To set up visual dashboards of DMARC data, install Elasticsearch and Kibana.
 
 .. note::
@@ -595,6 +599,41 @@ select ``dmarc_aggregate`` for the other saved objects, as shown below.
    :align: center
    :target: _static/screenshots/index-pattern-conflicts.png
 
+
+Splunk
+------
+
+Starting in version 4.1.1 ``parsedmarc`` supports sending aggregate and/or
+forensic DMARC data to a Splunk `HTTP Event collector (HEC)`_. Simply use the
+following command line options, along with ``--save-aggregate`` or
+``save-forensic``:
+
+
+::
+
+     --hec HEC             URL to a Splunk HTTP Event Collector (HEC)
+     --hec-token HEC_TOKEN
+                           The authorization token for a Splunk HTTP Event
+                           Collector (HEC)
+     --hec-index HEC_INDEX
+                           The index to use when sending events to the Splunk
+                           HTTP Event Collector (HEC)
+     --hec-skip-certificate-verification
+                           Skip certificate verification for Splunk HEC
+
+.. note::
+
+   It is possible to save data in Elasticsearch and splunk at the same time
+
+The project repository contains `XML files`_ for premade Splunk dashboards.
+Copy and paste the contents of each file into a separate Splunk dashboard XML
+editor.
+
+.. warning::
+
+   Change all occurrences of ``"index=email"`` in the XML to
+   match your own index name
+
 Running parsedmarc as a systemd service
 ---------------------------------------
 
@@ -856,3 +895,7 @@ Indices and tables
 .. _X-Pack: https://www.elastic.co/products/x-pack
 
 .. _kibana_saved_objects.json: https://raw.githubusercontent.com/domainaware/parsedmarc/master/kibana/kibana_saved_objects.json
+
+.. _HTTP Event collector (HEC): http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHEC
+
+.. _XML files: https://github.com/domainaware/parsedmarc/tree/master/splunk
\ No newline at end of file
diff --git a/_static/documentation_options.js b/_static/documentation_options.js
index dd04c83..ea0d066 100644
--- a/_static/documentation_options.js
+++ b/_static/documentation_options.js
@@ -1,6 +1,6 @@
 var DOCUMENTATION_OPTIONS = {
     URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'),
-    VERSION: '4.1.0',
+    VERSION: '4.1.',
     LANGUAGE: 'None',
     COLLAPSE_INDEX: false,
     FILE_SUFFIX: '.html',
diff --git a/genindex.html b/genindex.html
index 28c8069..79d992e 100644
--- a/genindex.html
+++ b/genindex.html
@@ -9,7 +9,7 @@
   
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   
-  <title>Index &mdash; parsedmarc 4.1.0 documentation</title>
+  <title>Index &mdash; parsedmarc 4.1. documentation</title>
   
 
   
@@ -57,7 +57,7 @@
             
             
               <div class="version">
-                4.1.0
+                4.1.
               </div>
             
           
@@ -316,7 +316,7 @@
     <script type="text/javascript">
         var DOCUMENTATION_OPTIONS = {
             URL_ROOT:'./',
-            VERSION:'4.1.0',
+            VERSION:'4.1.',
             LANGUAGE:'None',
             COLLAPSE_INDEX:false,
             FILE_SUFFIX:'.html',
diff --git a/index.html b/index.html
index 6ee81ba..6ceeb12 100644
--- a/index.html
+++ b/index.html
@@ -8,7 +8,7 @@
   
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   
-  <title>parsedmarc documentation - Open source DMARC report analyzer and visualizer &mdash; parsedmarc 4.1.0 documentation</title>
+  <title>parsedmarc documentation - Open source DMARC report analyzer and visualizer &mdash; parsedmarc 4.1. documentation</title>
   
 
   
@@ -56,7 +56,7 @@
             
             
               <div class="version">
-                4.1.0
+                4.1.
               </div>
             
           
@@ -100,6 +100,7 @@
 <li><a class="reference internal" href="#dns-performance">DNS performance</a></li>
 <li><a class="reference internal" href="#testing-multiple-report-analyzers">Testing multiple report analyzers</a></li>
 <li><a class="reference internal" href="#elasticsearch-and-kibana">Elasticsearch and Kibana</a></li>
+<li><a class="reference internal" href="#splunk">Splunk</a></li>
 <li><a class="reference internal" href="#running-parsedmarc-as-a-systemd-service">Running parsedmarc as a systemd service</a></li>
 </ul>
 </li>
@@ -221,84 +222,84 @@ dashboards</li>
                   <span class="p">[</span><span class="o">--</span><span class="n">hec</span><span class="o">-</span><span class="n">skip</span><span class="o">-</span><span class="n">certificate</span><span class="o">-</span><span class="n">verification</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">save</span><span class="o">-</span><span class="n">aggregate</span><span class="p">]</span>
                   <span class="p">[</span><span class="o">--</span><span class="n">save</span><span class="o">-</span><span class="n">forensic</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">O</span> <span class="n">OUTGOING_HOST</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">U</span> <span class="n">OUTGOING_USER</span><span class="p">]</span>
                   <span class="p">[</span><span class="o">-</span><span class="n">P</span> <span class="n">OUTGOING_PASSWORD</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">port</span> <span class="n">OUTGOING_PORT</span><span class="p">]</span>
-                  <span class="p">[</span><span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">ssl</span> <span class="n">OUTGOING_SSL</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">F</span> <span class="n">OUTG</span> <span class="n">OING_FROM</span><span class="p">]</span>
+                  <span class="p">[</span><span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">ssl</span> <span class="n">OUTGOING_SSL</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">F</span> <span class="n">OUTGOING_FROM</span><span class="p">]</span>
                   <span class="p">[</span><span class="o">-</span><span class="n">T</span> <span class="n">OUTGOING_TO</span> <span class="p">[</span><span class="n">OUTGOING_TO</span> <span class="o">...</span><span class="p">]]</span> <span class="p">[</span><span class="o">-</span><span class="n">S</span> <span class="n">OUTGOING_SUBJECT</span><span class="p">]</span>
                   <span class="p">[</span><span class="o">-</span><span class="n">A</span> <span class="n">OUTGOING_ATTACHMENT</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">M</span> <span class="n">OUTGOING_MESSAGE</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">w</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">test</span><span class="p">]</span>
                   <span class="p">[</span><span class="o">-</span><span class="n">s</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">debug</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">v</span><span class="p">]</span>
                   <span class="p">[</span><span class="n">file_path</span> <span class="p">[</span><span class="n">file_path</span> <span class="o">...</span><span class="p">]]</span>
 
-  <span class="n">Parses</span> <span class="n">DMARC</span> <span class="n">reports</span>
+ <span class="n">Parses</span> <span class="n">DMARC</span> <span class="n">reports</span>
 
-  <span class="n">positional</span> <span class="n">arguments</span><span class="p">:</span>
-    <span class="n">file_path</span>             <span class="n">one</span> <span class="ow">or</span> <span class="n">more</span> <span class="n">paths</span> <span class="n">to</span> <span class="n">aggregate</span> <span class="ow">or</span> <span class="n">forensic</span> <span class="n">report</span>
-                          <span class="n">files</span> <span class="ow">or</span> <span class="n">emails</span>
+ <span class="n">positional</span> <span class="n">arguments</span><span class="p">:</span>
+   <span class="n">file_path</span>             <span class="n">one</span> <span class="ow">or</span> <span class="n">more</span> <span class="n">paths</span> <span class="n">to</span> <span class="n">aggregate</span> <span class="ow">or</span> <span class="n">forensic</span> <span class="n">report</span>
+                         <span class="n">files</span> <span class="ow">or</span> <span class="n">emails</span>
 
-  <span class="n">optional</span> <span class="n">arguments</span><span class="p">:</span>
-    <span class="o">-</span><span class="n">h</span><span class="p">,</span> <span class="o">--</span><span class="n">help</span>            <span class="n">show</span> <span class="n">this</span> <span class="n">help</span> <span class="n">message</span> <span class="ow">and</span> <span class="n">exit</span>
-    <span class="o">-</span><span class="n">o</span> <span class="n">OUTPUT</span><span class="p">,</span> <span class="o">--</span><span class="n">output</span> <span class="n">OUTPUT</span>
-                          <span class="n">Write</span> <span class="n">output</span> <span class="n">files</span> <span class="n">to</span> <span class="n">the</span> <span class="n">given</span> <span class="n">directory</span>
-    <span class="o">-</span><span class="n">n</span> <span class="n">NAMESERVERS</span> <span class="p">[</span><span class="n">NAMESERVERS</span> <span class="o">...</span><span class="p">],</span> <span class="o">--</span><span class="n">nameservers</span> <span class="n">NAMESERVERS</span> <span class="p">[</span><span class="n">NAMESERVERS</span> <span class="o">...</span><span class="p">]</span>
-                          <span class="n">nameservers</span> <span class="n">to</span> <span class="n">query</span> <span class="p">(</span><span class="n">Default</span> <span class="ow">is</span> <span class="n">Cloudflare</span><span class="s1">&#39;s)</span>
-    <span class="o">-</span><span class="n">t</span> <span class="n">TIMEOUT</span><span class="p">,</span> <span class="o">--</span><span class="n">timeout</span> <span class="n">TIMEOUT</span>
-                          <span class="n">number</span> <span class="n">of</span> <span class="n">seconds</span> <span class="n">to</span> <span class="n">wait</span> <span class="k">for</span> <span class="n">an</span> <span class="n">answer</span> <span class="kn">from</span> <span class="nn">DNS</span>
-                          <span class="p">(</span><span class="n">default</span> <span class="mf">2.0</span><span class="p">)</span>
-    <span class="o">-</span><span class="n">H</span> <span class="n">HOST</span><span class="p">,</span> <span class="o">--</span><span class="n">host</span> <span class="n">HOST</span>  <span class="n">IMAP</span> <span class="n">hostname</span> <span class="ow">or</span> <span class="n">IP</span> <span class="n">address</span>
-    <span class="o">-</span><span class="n">u</span> <span class="n">USER</span><span class="p">,</span> <span class="o">--</span><span class="n">user</span> <span class="n">USER</span>  <span class="n">IMAP</span> <span class="n">user</span>
-    <span class="o">-</span><span class="n">p</span> <span class="n">PASSWORD</span><span class="p">,</span> <span class="o">--</span><span class="n">password</span> <span class="n">PASSWORD</span>
-                          <span class="n">IMAP</span> <span class="n">password</span>
-    <span class="o">-</span><span class="n">r</span> <span class="n">REPORTS_FOLDER</span><span class="p">,</span> <span class="o">--</span><span class="n">reports</span><span class="o">-</span><span class="n">folder</span> <span class="n">REPORTS_FOLDER</span>
-                          <span class="n">The</span> <span class="n">IMAP</span> <span class="n">folder</span> <span class="n">containing</span> <span class="n">the</span> <span class="n">reports</span> <span class="n">Default</span><span class="p">:</span> <span class="n">INBOX</span>
-    <span class="o">-</span><span class="n">a</span> <span class="n">ARCHIVE_FOLDER</span><span class="p">,</span> <span class="o">--</span><span class="n">archive</span><span class="o">-</span><span class="n">folder</span> <span class="n">ARCHIVE_FOLDER</span>
-                          <span class="n">Specifies</span> <span class="n">the</span> <span class="n">IMAP</span> <span class="n">folder</span> <span class="n">to</span> <span class="n">move</span> <span class="n">messages</span> <span class="n">to</span> <span class="n">after</span>
-                          <span class="n">processing</span> <span class="n">them</span> <span class="n">Default</span><span class="p">:</span> <span class="n">Archive</span>
-    <span class="o">-</span><span class="n">d</span><span class="p">,</span> <span class="o">--</span><span class="n">delete</span>          <span class="n">Delete</span> <span class="n">the</span> <span class="n">reports</span> <span class="n">after</span> <span class="n">processing</span> <span class="n">them</span>
-    <span class="o">-</span><span class="n">E</span> <span class="p">[</span><span class="n">ELASTICSEARCH_HOST</span> <span class="p">[</span><span class="n">ELASTICSEARCH_HOST</span> <span class="o">...</span><span class="p">]],</span> <span class="o">--</span><span class="n">elasticsearch</span><span class="o">-</span><span class="n">host</span> <span class="p">[</span><span class="n">ELASTICSEARCH_HOST</span> <span class="p">[</span><span class="n">ELASTICSEARCH_HOST</span> <span class="o">...</span><span class="p">]]</span>
-                          <span class="n">A</span> <span class="nb">list</span> <span class="n">of</span> <span class="n">one</span> <span class="ow">or</span> <span class="n">more</span> <span class="n">Elasticsearch</span> <span class="n">hostnames</span> <span class="ow">or</span> <span class="n">URLs</span>
-                          <span class="n">to</span> <span class="n">use</span> <span class="p">(</span><span class="n">e</span><span class="o">.</span><span class="n">g</span><span class="o">.</span> <span class="n">localhost</span><span class="p">:</span><span class="mi">9200</span><span class="p">)</span>
-    <span class="o">--</span><span class="n">elasticsearch</span><span class="o">-</span><span class="n">index</span><span class="o">-</span><span class="n">prefix</span> <span class="n">ELASTICSEARCH_INDEX_PREFIX</span>
-                          <span class="n">Prefix</span> <span class="n">to</span> <span class="n">add</span> <span class="ow">in</span> <span class="n">front</span> <span class="n">of</span> <span class="n">the</span> <span class="n">dmarc_aggregate</span> <span class="ow">and</span>
-                          <span class="n">dmarc_forensic</span> <span class="n">Elasticsearch</span> <span class="n">index</span> <span class="n">names</span><span class="p">,</span> <span class="n">joined</span> <span class="n">by</span> <span class="n">_</span>
-    <span class="o">--</span><span class="n">elasticsearch</span><span class="o">-</span><span class="n">index</span><span class="o">-</span><span class="n">suffix</span> <span class="n">ELASTICSEARCH_INDEX_SUFFIX</span>
-                          <span class="n">Append</span> <span class="n">this</span> <span class="n">suffix</span> <span class="n">to</span> <span class="n">the</span> <span class="n">dmarc_aggregate</span> <span class="ow">and</span>
-                          <span class="n">dmarc_forensic</span> <span class="n">Elasticsearch</span> <span class="n">index</span> <span class="n">names</span><span class="p">,</span> <span class="n">joined</span> <span class="n">by</span> <span class="n">_</span>
-    <span class="o">--</span><span class="n">hec</span> <span class="n">HEC</span>             <span class="n">URL</span> <span class="n">to</span> <span class="n">a</span> <span class="n">Splunk</span> <span class="n">HTTP</span> <span class="n">Event</span> <span class="n">Collector</span> <span class="p">(</span><span class="n">HEC</span><span class="p">)</span>
-    <span class="o">--</span><span class="n">hec</span><span class="o">-</span><span class="n">token</span> <span class="n">HEC_TOKEN</span>
-                          <span class="n">The</span> <span class="n">authorization</span> <span class="n">token</span> <span class="k">for</span> <span class="n">a</span> <span class="n">Splunk</span> <span class="n">HTTP</span> <span class="n">event</span>
-                          <span class="n">collector</span> <span class="p">(</span><span class="n">HEC</span><span class="p">)</span>
-    <span class="o">--</span><span class="n">hec</span><span class="o">-</span><span class="n">index</span> <span class="n">HEC_INDEX</span>
-                          <span class="n">The</span> <span class="n">index</span> <span class="n">to</span> <span class="n">use</span> <span class="n">when</span> <span class="n">sending</span> <span class="n">events</span> <span class="n">to</span> <span class="n">the</span> <span class="n">Splunk</span>
-                          <span class="n">HTTP</span> <span class="n">Events</span>
-    <span class="o">--</span><span class="n">hec</span><span class="o">-</span><span class="n">skip</span><span class="o">-</span><span class="n">certificate</span><span class="o">-</span><span class="n">verification</span>
-                          <span class="n">Skip</span> <span class="n">certificate</span> <span class="n">verification</span> <span class="k">for</span> <span class="n">Splunk</span> <span class="n">HEC</span>
-    <span class="o">--</span><span class="n">save</span><span class="o">-</span><span class="n">aggregate</span>      <span class="n">Save</span> <span class="n">aggregate</span> <span class="n">reports</span> <span class="n">to</span> <span class="n">search</span> <span class="n">indexes</span>
-    <span class="o">--</span><span class="n">save</span><span class="o">-</span><span class="n">forensic</span>       <span class="n">Save</span> <span class="n">forensic</span> <span class="n">reports</span> <span class="n">to</span> <span class="n">search</span> <span class="n">indexes</span>
-    <span class="o">-</span><span class="n">O</span> <span class="n">OUTGOING_HOST</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">host</span> <span class="n">OUTGOING_HOST</span>
-                          <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">host</span>
-    <span class="o">-</span><span class="n">U</span> <span class="n">OUTGOING_USER</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">user</span> <span class="n">OUTGOING_USER</span>
-                          <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">user</span>
-    <span class="o">-</span><span class="n">P</span> <span class="n">OUTGOING_PASSWORD</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">password</span> <span class="n">OUTGOING_PASSWORD</span>
-                          <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">password</span>
-    <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">port</span> <span class="n">OUTGOING_PORT</span>
-                          <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">port</span>
-    <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">ssl</span> <span class="n">OUTGOING_SSL</span>
-                          <span class="n">Use</span> <span class="n">SSL</span><span class="o">/</span><span class="n">TLS</span> <span class="n">instead</span> <span class="n">of</span> <span class="n">STARTTLS</span> <span class="p">(</span><span class="n">more</span> <span class="n">secure</span><span class="p">,</span> <span class="ow">and</span>
-                          <span class="n">required</span> <span class="n">by</span> <span class="n">some</span> <span class="n">providers</span><span class="p">,</span> <span class="n">like</span> <span class="n">Gmail</span><span class="p">)</span>
-    <span class="o">-</span><span class="n">F</span> <span class="n">OUTGOING_FROM</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="kn">from</span> <span class="nn">OUTGOING_FROM</span>
-                          <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="kn">from</span> <span class="nn">address</span>
-    <span class="o">-</span><span class="n">T</span> <span class="n">OUTGOING_TO</span> <span class="p">[</span><span class="n">OUTGOING_TO</span> <span class="o">...</span><span class="p">],</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">to</span> <span class="n">OUTGOING_TO</span> <span class="p">[</span><span class="n">OUTGOING_TO</span> <span class="o">...</span><span class="p">]</span>
-                          <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">to</span> <span class="n">these</span> <span class="n">addresses</span>
-    <span class="o">-</span><span class="n">S</span> <span class="n">OUTGOING_SUBJECT</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">subject</span> <span class="n">OUTGOING_SUBJECT</span>
-                          <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">subject</span>
-    <span class="o">-</span><span class="n">A</span> <span class="n">OUTGOING_ATTACHMENT</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">attachment</span> <span class="n">OUTGOING_ATTACHMENT</span>
-                          <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">filename</span>
-    <span class="o">-</span><span class="n">M</span> <span class="n">OUTGOING_MESSAGE</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">message</span> <span class="n">OUTGOING_MESSAGE</span>
-                          <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">message</span>
-    <span class="o">-</span><span class="n">w</span><span class="p">,</span> <span class="o">--</span><span class="n">watch</span>           <span class="n">Use</span> <span class="n">an</span> <span class="n">IMAP</span> <span class="n">IDLE</span> <span class="n">connection</span> <span class="n">to</span> <span class="n">process</span> <span class="n">reports</span> <span class="k">as</span> <span class="n">they</span>
-                          <span class="n">arrive</span> <span class="ow">in</span> <span class="n">the</span> <span class="n">inbox</span>
-    <span class="o">--</span><span class="n">test</span>                <span class="n">Do</span> <span class="ow">not</span> <span class="n">move</span> <span class="ow">or</span> <span class="n">delete</span> <span class="n">IMAP</span> <span class="n">messages</span>
-    <span class="o">-</span><span class="n">s</span><span class="p">,</span> <span class="o">--</span><span class="n">silent</span>          <span class="n">Only</span> <span class="nb">print</span> <span class="n">errors</span>
-    <span class="o">--</span><span class="n">debug</span>               <span class="n">Print</span> <span class="n">debugging</span> <span class="n">information</span>
-    <span class="o">-</span><span class="n">v</span><span class="p">,</span> <span class="o">--</span><span class="n">version</span>         <span class="n">show</span> <span class="n">program</span><span class="s1">&#39;s version number and exit</span>
+ <span class="n">optional</span> <span class="n">arguments</span><span class="p">:</span>
+   <span class="o">-</span><span class="n">h</span><span class="p">,</span> <span class="o">--</span><span class="n">help</span>            <span class="n">show</span> <span class="n">this</span> <span class="n">help</span> <span class="n">message</span> <span class="ow">and</span> <span class="n">exit</span>
+   <span class="o">-</span><span class="n">o</span> <span class="n">OUTPUT</span><span class="p">,</span> <span class="o">--</span><span class="n">output</span> <span class="n">OUTPUT</span>
+                         <span class="n">Write</span> <span class="n">output</span> <span class="n">files</span> <span class="n">to</span> <span class="n">the</span> <span class="n">given</span> <span class="n">directory</span>
+   <span class="o">-</span><span class="n">n</span> <span class="n">NAMESERVERS</span> <span class="p">[</span><span class="n">NAMESERVERS</span> <span class="o">...</span><span class="p">],</span> <span class="o">--</span><span class="n">nameservers</span> <span class="n">NAMESERVERS</span> <span class="p">[</span><span class="n">NAMESERVERS</span> <span class="o">...</span><span class="p">]</span>
+                         <span class="n">nameservers</span> <span class="n">to</span> <span class="n">query</span> <span class="p">(</span><span class="n">Default</span> <span class="ow">is</span> <span class="n">Cloudflare</span><span class="s1">&#39;s)</span>
+   <span class="o">-</span><span class="n">t</span> <span class="n">TIMEOUT</span><span class="p">,</span> <span class="o">--</span><span class="n">timeout</span> <span class="n">TIMEOUT</span>
+                         <span class="n">number</span> <span class="n">of</span> <span class="n">seconds</span> <span class="n">to</span> <span class="n">wait</span> <span class="k">for</span> <span class="n">an</span> <span class="n">answer</span> <span class="kn">from</span> <span class="nn">DNS</span>
+                         <span class="p">(</span><span class="n">default</span> <span class="mf">2.0</span><span class="p">)</span>
+   <span class="o">-</span><span class="n">H</span> <span class="n">HOST</span><span class="p">,</span> <span class="o">--</span><span class="n">host</span> <span class="n">HOST</span>  <span class="n">IMAP</span> <span class="n">hostname</span> <span class="ow">or</span> <span class="n">IP</span> <span class="n">address</span>
+   <span class="o">-</span><span class="n">u</span> <span class="n">USER</span><span class="p">,</span> <span class="o">--</span><span class="n">user</span> <span class="n">USER</span>  <span class="n">IMAP</span> <span class="n">user</span>
+   <span class="o">-</span><span class="n">p</span> <span class="n">PASSWORD</span><span class="p">,</span> <span class="o">--</span><span class="n">password</span> <span class="n">PASSWORD</span>
+                         <span class="n">IMAP</span> <span class="n">password</span>
+   <span class="o">-</span><span class="n">r</span> <span class="n">REPORTS_FOLDER</span><span class="p">,</span> <span class="o">--</span><span class="n">reports</span><span class="o">-</span><span class="n">folder</span> <span class="n">REPORTS_FOLDER</span>
+                         <span class="n">The</span> <span class="n">IMAP</span> <span class="n">folder</span> <span class="n">containing</span> <span class="n">the</span> <span class="n">reports</span> <span class="n">Default</span><span class="p">:</span> <span class="n">INBOX</span>
+   <span class="o">-</span><span class="n">a</span> <span class="n">ARCHIVE_FOLDER</span><span class="p">,</span> <span class="o">--</span><span class="n">archive</span><span class="o">-</span><span class="n">folder</span> <span class="n">ARCHIVE_FOLDER</span>
+                         <span class="n">Specifies</span> <span class="n">the</span> <span class="n">IMAP</span> <span class="n">folder</span> <span class="n">to</span> <span class="n">move</span> <span class="n">messages</span> <span class="n">to</span> <span class="n">after</span>
+                         <span class="n">processing</span> <span class="n">them</span> <span class="n">Default</span><span class="p">:</span> <span class="n">Archive</span>
+   <span class="o">-</span><span class="n">d</span><span class="p">,</span> <span class="o">--</span><span class="n">delete</span>          <span class="n">Delete</span> <span class="n">the</span> <span class="n">reports</span> <span class="n">after</span> <span class="n">processing</span> <span class="n">them</span>
+   <span class="o">-</span><span class="n">E</span> <span class="p">[</span><span class="n">ELASTICSEARCH_HOST</span> <span class="p">[</span><span class="n">ELASTICSEARCH_HOST</span> <span class="o">...</span><span class="p">]],</span> <span class="o">--</span><span class="n">elasticsearch</span><span class="o">-</span><span class="n">host</span> <span class="p">[</span><span class="n">ELASTICSEARCH_HOST</span> <span class="p">[</span><span class="n">ELASTICSEARCH_HOST</span> <span class="o">...</span><span class="p">]]</span>
+                         <span class="n">A</span> <span class="nb">list</span> <span class="n">of</span> <span class="n">one</span> <span class="ow">or</span> <span class="n">more</span> <span class="n">Elasticsearch</span> <span class="n">hostnames</span> <span class="ow">or</span> <span class="n">URLs</span>
+                         <span class="n">to</span> <span class="n">use</span> <span class="p">(</span><span class="n">e</span><span class="o">.</span><span class="n">g</span><span class="o">.</span> <span class="n">localhost</span><span class="p">:</span><span class="mi">9200</span><span class="p">)</span>
+   <span class="o">--</span><span class="n">elasticsearch</span><span class="o">-</span><span class="n">index</span><span class="o">-</span><span class="n">prefix</span> <span class="n">ELASTICSEARCH_INDEX_PREFIX</span>
+                         <span class="n">Prefix</span> <span class="n">to</span> <span class="n">add</span> <span class="ow">in</span> <span class="n">front</span> <span class="n">of</span> <span class="n">the</span> <span class="n">dmarc_aggregate</span> <span class="ow">and</span>
+                         <span class="n">dmarc_forensic</span> <span class="n">Elasticsearch</span> <span class="n">index</span> <span class="n">names</span><span class="p">,</span> <span class="n">joined</span> <span class="n">by</span> <span class="n">_</span>
+   <span class="o">--</span><span class="n">elasticsearch</span><span class="o">-</span><span class="n">index</span><span class="o">-</span><span class="n">suffix</span> <span class="n">ELASTICSEARCH_INDEX_SUFFIX</span>
+                         <span class="n">Append</span> <span class="n">this</span> <span class="n">suffix</span> <span class="n">to</span> <span class="n">the</span> <span class="n">dmarc_aggregate</span> <span class="ow">and</span>
+                         <span class="n">dmarc_forensic</span> <span class="n">Elasticsearch</span> <span class="n">index</span> <span class="n">names</span><span class="p">,</span> <span class="n">joined</span> <span class="n">by</span> <span class="n">_</span>
+   <span class="o">--</span><span class="n">hec</span> <span class="n">HEC</span>             <span class="n">URL</span> <span class="n">to</span> <span class="n">a</span> <span class="n">Splunk</span> <span class="n">HTTP</span> <span class="n">Event</span> <span class="n">Collector</span> <span class="p">(</span><span class="n">HEC</span><span class="p">)</span>
+   <span class="o">--</span><span class="n">hec</span><span class="o">-</span><span class="n">token</span> <span class="n">HEC_TOKEN</span>
+                         <span class="n">The</span> <span class="n">authorization</span> <span class="n">token</span> <span class="k">for</span> <span class="n">a</span> <span class="n">Splunk</span> <span class="n">HTTP</span> <span class="n">Event</span>
+                         <span class="n">Collector</span> <span class="p">(</span><span class="n">HEC</span><span class="p">)</span>
+   <span class="o">--</span><span class="n">hec</span><span class="o">-</span><span class="n">index</span> <span class="n">HEC_INDEX</span>
+                         <span class="n">The</span> <span class="n">index</span> <span class="n">to</span> <span class="n">use</span> <span class="n">when</span> <span class="n">sending</span> <span class="n">events</span> <span class="n">to</span> <span class="n">the</span> <span class="n">Splunk</span>
+                         <span class="n">HTTP</span> <span class="n">Event</span> <span class="n">Collector</span> <span class="p">(</span><span class="n">HEC</span><span class="p">)</span>
+   <span class="o">--</span><span class="n">hec</span><span class="o">-</span><span class="n">skip</span><span class="o">-</span><span class="n">certificate</span><span class="o">-</span><span class="n">verification</span>
+                         <span class="n">Skip</span> <span class="n">certificate</span> <span class="n">verification</span> <span class="k">for</span> <span class="n">Splunk</span> <span class="n">HEC</span>
+   <span class="o">--</span><span class="n">save</span><span class="o">-</span><span class="n">aggregate</span>      <span class="n">Save</span> <span class="n">aggregate</span> <span class="n">reports</span> <span class="n">to</span> <span class="n">search</span> <span class="n">indexes</span>
+   <span class="o">--</span><span class="n">save</span><span class="o">-</span><span class="n">forensic</span>       <span class="n">Save</span> <span class="n">forensic</span> <span class="n">reports</span> <span class="n">to</span> <span class="n">search</span> <span class="n">indexes</span>
+   <span class="o">-</span><span class="n">O</span> <span class="n">OUTGOING_HOST</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">host</span> <span class="n">OUTGOING_HOST</span>
+                         <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">host</span>
+   <span class="o">-</span><span class="n">U</span> <span class="n">OUTGOING_USER</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">user</span> <span class="n">OUTGOING_USER</span>
+                         <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">user</span>
+   <span class="o">-</span><span class="n">P</span> <span class="n">OUTGOING_PASSWORD</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">password</span> <span class="n">OUTGOING_PASSWORD</span>
+                         <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">password</span>
+   <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">port</span> <span class="n">OUTGOING_PORT</span>
+                         <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">port</span>
+   <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">ssl</span> <span class="n">OUTGOING_SSL</span>
+                         <span class="n">Use</span> <span class="n">SSL</span><span class="o">/</span><span class="n">TLS</span> <span class="n">instead</span> <span class="n">of</span> <span class="n">STARTTLS</span> <span class="p">(</span><span class="n">more</span> <span class="n">secure</span><span class="p">,</span> <span class="ow">and</span>
+                         <span class="n">required</span> <span class="n">by</span> <span class="n">some</span> <span class="n">providers</span><span class="p">,</span> <span class="n">like</span> <span class="n">Gmail</span><span class="p">)</span>
+   <span class="o">-</span><span class="n">F</span> <span class="n">OUTGOING_FROM</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="kn">from</span> <span class="nn">OUTGOING_FROM</span>
+                         <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="kn">from</span> <span class="nn">address</span>
+   <span class="o">-</span><span class="n">T</span> <span class="n">OUTGOING_TO</span> <span class="p">[</span><span class="n">OUTGOING_TO</span> <span class="o">...</span><span class="p">],</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">to</span> <span class="n">OUTGOING_TO</span> <span class="p">[</span><span class="n">OUTGOING_TO</span> <span class="o">...</span><span class="p">]</span>
+                         <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">to</span> <span class="n">these</span> <span class="n">addresses</span>
+   <span class="o">-</span><span class="n">S</span> <span class="n">OUTGOING_SUBJECT</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">subject</span> <span class="n">OUTGOING_SUBJECT</span>
+                         <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">subject</span>
+   <span class="o">-</span><span class="n">A</span> <span class="n">OUTGOING_ATTACHMENT</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">attachment</span> <span class="n">OUTGOING_ATTACHMENT</span>
+                         <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">filename</span>
+   <span class="o">-</span><span class="n">M</span> <span class="n">OUTGOING_MESSAGE</span><span class="p">,</span> <span class="o">--</span><span class="n">outgoing</span><span class="o">-</span><span class="n">message</span> <span class="n">OUTGOING_MESSAGE</span>
+                         <span class="n">Email</span> <span class="n">the</span> <span class="n">results</span> <span class="n">using</span> <span class="n">this</span> <span class="n">message</span>
+   <span class="o">-</span><span class="n">w</span><span class="p">,</span> <span class="o">--</span><span class="n">watch</span>           <span class="n">Use</span> <span class="n">an</span> <span class="n">IMAP</span> <span class="n">IDLE</span> <span class="n">connection</span> <span class="n">to</span> <span class="n">process</span> <span class="n">reports</span> <span class="k">as</span> <span class="n">they</span>
+                         <span class="n">arrive</span> <span class="ow">in</span> <span class="n">the</span> <span class="n">inbox</span>
+   <span class="o">--</span><span class="n">test</span>                <span class="n">Do</span> <span class="ow">not</span> <span class="n">move</span> <span class="ow">or</span> <span class="n">delete</span> <span class="n">IMAP</span> <span class="n">messages</span>
+   <span class="o">-</span><span class="n">s</span><span class="p">,</span> <span class="o">--</span><span class="n">silent</span>          <span class="n">Only</span> <span class="nb">print</span> <span class="n">errors</span>
+   <span class="o">--</span><span class="n">debug</span>               <span class="n">Print</span> <span class="n">debugging</span> <span class="n">information</span>
+   <span class="o">-</span><span class="n">v</span><span class="p">,</span> <span class="o">--</span><span class="n">version</span>         <span class="n">show</span> <span class="n">program</span><span class="s1">&#39;s version number and exit</span>
 </pre></div>
 </div>
 </div>
@@ -424,7 +425,7 @@ macOS or Linux, run</p>
 </div>
 <div class="admonition note">
 <p class="first admonition-title">Note</p>
-<p class="last">On Windows, <code class="docutils literal notranslate"><span class="pre">pip3</span></code> is <code class="docutils literal notranslate"><span class="pre">pip</span></code>, even with Python 3. So on Windows, simply
+<p class="last">On Windows, <code class="docutils literal notranslate"><span class="pre">pip3</span></code> is <code class="docutils literal notranslate"><span class="pre">pip</span></code>, even with Python 3. So on Windows,
 substitute <code class="docutils literal notranslate"><span class="pre">pip</span></code> as an administrator in place of <code class="docutils literal notranslate"><span class="pre">sudo</span> <span class="pre">pip3</span></code>, in the
 above commands.</p>
 </div>
@@ -490,10 +491,14 @@ not match records in the public DNS.</p>
 <h3>Testing multiple report analyzers<a class="headerlink" href="#testing-multiple-report-analyzers" title="Permalink to this headline">¶</a></h3>
 <p>If you would like to test parsedmarc and another report processing solution
 at the same time, you can have up to two mailto URIs each in the rua and ruf
-tags tgs in your DMARC record, separated by commas.</p>
+tags in your DMARC record, separated by commas.</p>
 </div>
 <div class="section" id="elasticsearch-and-kibana">
 <h3>Elasticsearch and Kibana<a class="headerlink" href="#elasticsearch-and-kibana" title="Permalink to this headline">¶</a></h3>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p class="last">Splunk is also supported starting with <code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> 4.1.1</p>
+</div>
 <p>To set up visual dashboards of DMARC data, install Elasticsearch and Kibana.</p>
 <div class="admonition note">
 <p class="first admonition-title">Note</p>
@@ -648,6 +653,36 @@ patterns. Select <code class="docutils literal notranslate"><span class="pre">dm
 select <code class="docutils literal notranslate"><span class="pre">dmarc_aggregate</span></code> for the other saved objects, as shown below.</p>
 <a class="reference external image-reference" href="_static/screenshots/index-pattern-conflicts.png"><img alt="A screenshot showing how to resolve index pattern conflicts after importing saved objects" class="align-center" src="_images/index-pattern-conflicts.png" /></a>
 </div>
+<div class="section" id="splunk">
+<h3>Splunk<a class="headerlink" href="#splunk" title="Permalink to this headline">¶</a></h3>
+<p>Starting in version 4.1.1 <code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> supports sending aggregate and/or
+forensic DMARC data to a Splunk <a class="reference external" href="http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHEC">HTTP Event collector (HEC)</a>. Simply use the
+following command line options, along with <code class="docutils literal notranslate"><span class="pre">--save-aggregate</span></code> or
+<code class="docutils literal notranslate"><span class="pre">save-forensic</span></code>:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="o">--</span><span class="n">hec</span> <span class="n">HEC</span>             <span class="n">URL</span> <span class="n">to</span> <span class="n">a</span> <span class="n">Splunk</span> <span class="n">HTTP</span> <span class="n">Event</span> <span class="n">Collector</span> <span class="p">(</span><span class="n">HEC</span><span class="p">)</span>
+<span class="o">--</span><span class="n">hec</span><span class="o">-</span><span class="n">token</span> <span class="n">HEC_TOKEN</span>
+                      <span class="n">The</span> <span class="n">authorization</span> <span class="n">token</span> <span class="k">for</span> <span class="n">a</span> <span class="n">Splunk</span> <span class="n">HTTP</span> <span class="n">Event</span>
+                      <span class="n">Collector</span> <span class="p">(</span><span class="n">HEC</span><span class="p">)</span>
+<span class="o">--</span><span class="n">hec</span><span class="o">-</span><span class="n">index</span> <span class="n">HEC_INDEX</span>
+                      <span class="n">The</span> <span class="n">index</span> <span class="n">to</span> <span class="n">use</span> <span class="n">when</span> <span class="n">sending</span> <span class="n">events</span> <span class="n">to</span> <span class="n">the</span> <span class="n">Splunk</span>
+                      <span class="n">HTTP</span> <span class="n">Event</span> <span class="n">Collector</span> <span class="p">(</span><span class="n">HEC</span><span class="p">)</span>
+<span class="o">--</span><span class="n">hec</span><span class="o">-</span><span class="n">skip</span><span class="o">-</span><span class="n">certificate</span><span class="o">-</span><span class="n">verification</span>
+                      <span class="n">Skip</span> <span class="n">certificate</span> <span class="n">verification</span> <span class="k">for</span> <span class="n">Splunk</span> <span class="n">HEC</span>
+</pre></div>
+</div>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p class="last">It is possible to save data in Elasticsearch and splunk at the same time</p>
+</div>
+<p>The project repository contains <a class="reference external" href="https://github.com/domainaware/parsedmarc/tree/master/splunk">XML files</a> for premade Splunk dashboards.
+Copy and paste the contents of each file into a separate Splunk dashboard XML
+editor.</p>
+<div class="admonition warning">
+<p class="first admonition-title">Warning</p>
+<p class="last">Change all occurrences of <code class="docutils literal notranslate"><span class="pre">&quot;index=email&quot;</span></code> in the XML to
+match your own index name</p>
+</div>
+</div>
 <div class="section" id="running-parsedmarc-as-a-systemd-service">
 <h3>Running parsedmarc as a systemd service<a class="headerlink" href="#running-parsedmarc-as-a-systemd-service" title="Permalink to this headline">¶</a></h3>
 <p>Use systemd to run <code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> as a service and process reports as they
@@ -1413,7 +1448,7 @@ to a callback function</p>
     <script type="text/javascript">
         var DOCUMENTATION_OPTIONS = {
             URL_ROOT:'./',
-            VERSION:'4.1.0',
+            VERSION:'4.1.',
             LANGUAGE:'None',
             COLLAPSE_INDEX:false,
             FILE_SUFFIX:'.html',
diff --git a/objects.inv b/objects.inv
index 3b2c22f549fa4f37ec73ddfeb2001ea9e4835e4f..e9b4d913b720de9423ac0f2ad7c25411b636d68f 100644
GIT binary patch
delta 10
RcmdnMvYusv(?;jFi~tt21RMYW

delta 12
TcmZ3_vVmoS6QjXKr?-p%92o>m

diff --git a/py-modindex.html b/py-modindex.html
index 3332f70..4595b6d 100644
--- a/py-modindex.html
+++ b/py-modindex.html
@@ -8,7 +8,7 @@
   
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   
-  <title>Python Module Index &mdash; parsedmarc 4.1.0 documentation</title>
+  <title>Python Module Index &mdash; parsedmarc 4.1. documentation</title>
   
 
   
@@ -59,7 +59,7 @@
             
             
               <div class="version">
-                4.1.0
+                4.1.
               </div>
             
           
@@ -200,7 +200,7 @@
     <script type="text/javascript">
         var DOCUMENTATION_OPTIONS = {
             URL_ROOT:'./',
-            VERSION:'4.1.0',
+            VERSION:'4.1.',
             LANGUAGE:'None',
             COLLAPSE_INDEX:false,
             FILE_SUFFIX:'.html',
diff --git a/search.html b/search.html
index 28f4210..cdb4c3e 100644
--- a/search.html
+++ b/search.html
@@ -8,7 +8,7 @@
   
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   
-  <title>Search &mdash; parsedmarc 4.1.0 documentation</title>
+  <title>Search &mdash; parsedmarc 4.1. documentation</title>
   
 
   
@@ -56,7 +56,7 @@
             
             
               <div class="version">
-                4.1.0
+                4.1.
               </div>
             
           
@@ -188,7 +188,7 @@
     <script type="text/javascript">
         var DOCUMENTATION_OPTIONS = {
             URL_ROOT:'./',
-            VERSION:'4.1.0',
+            VERSION:'4.1.',
             LANGUAGE:'None',
             COLLAPSE_INDEX:false,
             FILE_SUFFIX:'.html',
diff --git a/searchindex.js b/searchindex.js
index 47bfe52..fc785ae 100644
--- a/searchindex.js
+++ b/searchindex.js
@@ -1 +1 @@
-Search.setIndex({docnames:["index"],envversion:55,filenames:["index.rst"],objects:{"":{parsedmarc:[0,0,0,"-"]},"parsedmarc.elastic":{AlreadySaved:[0,1,1,""],create_indexes:[0,2,1,""],save_aggregate_report_to_elasticsearch:[0,2,1,""],save_forensic_report_to_elasticsearch:[0,2,1,""],set_hosts:[0,2,1,""]},parsedmarc:{IMAPError:[0,1,1,""],InvalidAggregateReport:[0,1,1,""],InvalidDMARCReport:[0,1,1,""],InvalidForensicReport:[0,1,1,""],ParserError:[0,1,1,""],SMTPError:[0,1,1,""],elastic:[0,0,0,"-"],email_results:[0,2,1,""],extract_xml:[0,2,1,""],get_dmarc_reports_from_inbox:[0,2,1,""],get_imap_capabilities:[0,2,1,""],get_report_zip:[0,2,1,""],human_timestamp_to_datetime:[0,2,1,""],human_timestamp_to_timestamp:[0,2,1,""],parse_aggregate_report_file:[0,2,1,""],parse_aggregate_report_xml:[0,2,1,""],parse_forensic_report:[0,2,1,""],parse_report_email:[0,2,1,""],parse_report_file:[0,2,1,""],parsed_aggregate_reports_to_csv:[0,2,1,""],parsed_forensic_reports_to_csv:[0,2,1,""],save_output:[0,2,1,""],watch_inbox:[0,2,1,""]}},objnames:{"0":["py","module","Python module"],"1":["py","exception","Python exception"],"2":["py","function","Python function"]},objtypes:{"0":"py:module","1":"py:exception","2":"py:function"},terms:{"50m":0,"break":0,"byte":0,"case":0,"default":0,"float":0,"function":0,"import":0,"int":0,"long":0,"new":0,"null":0,"public":0,"return":0,"switch":0,"true":0,"while":0,For:0,OLE:0,TLS:0,That:0,The:0,Then:0,These:0,Use:0,With:0,_input:0,abl:0,about:0,abov:0,access:0,account:0,acm:0,across:0,actual:0,add:0,add_head:0,address:0,addresse:0,adkim:0,administr:0,adsl:0,aes128:0,aes256:0,after:0,against:0,agari:0,age:0,aggregate_report:0,all:0,alreadysav:0,also:0,alter:0,altern:0,alwai:0,ani:0,anoth:0,answer:0,apache2:0,appear:0,append:0,appendix:0,apt:0,archiv:0,archive_fold:0,argument:0,arriv:0,arrival_d:0,artifact:0,ask:0,aspf:0,attach:0,attachment_filenam:0,auth_bas:0,auth_basic_user_fil:0,auth_result:0,authent:0,author:0,autodetect:0,avail:0,avoid:0,b2c:0,base:0,base_domain:0,basic:0,becaus:0,been:0,begin_d:0,bellsouth:0,below:0,best:0,between:0,bin:0,bodi:0,bool:0,brand:0,busi:0,call:0,callback:0,can:0,capabl:0,caus:0,center:0,cert:0,certif:0,chacha20:0,chang:0,chart:0,check:0,checkdmarc:0,chines:0,chmod:0,chown:0,click:0,cloudflar:0,collect:0,collector:0,com:0,come:0,comma:0,command:0,commerci:0,common:0,compress:0,configur:0,connect:0,consid:0,consist:0,consolid:0,consum:0,contact:0,contain:0,content:0,context:0,control:0,convert:0,copi:0,correctli:0,could:0,count:0,countri:0,crash:0,creat:0,create_index:0,crt:0,csr:0,current:0,custom:0,daemon:0,dai:0,daili:0,data:0,date_rang:0,datetim:0,deb:0,debian:0,debug:0,delet:0,demystifi:0,descript:0,detail:0,develop:0,dict:0,differ:0,directli:0,directori:0,disabl:0,displai:0,disposit:0,dkim_align:0,dkim_domain:0,dkim_result:0,dkim_selector:0,dkm:0,dmarc_aggreg:0,dmarc_forens:0,dmarcian:0,dns_timeout:0,doe:0,domain:0,domainawar:0,don:0,done:0,down:0,download:0,draft:0,each:0,earlier:0,ecdh:0,ecdsa:0,echo:0,edit:0,elasticsearch_host:0,elasticsearch_index_prefix:0,elasticsearch_index_suffix:0,els:0,email:0,email_result:0,enabl:0,encount:0,end:0,end_dat:0,ensur:0,entir:0,envelop:0,envelope_from:0,envelope_to:0,error:0,especi:0,etc:0,even:0,event:0,everi:0,exampl:0,exampleus:0,except:0,execstart:0,exist:0,exit:0,extract:0,extract_xml:0,fail:0,failur:0,fals:0,feedback:0,feedback_report:0,fetch:0,few:0,field:0,file:0,file_path:0,filenam:0,fill:0,filter:0,financ:0,find:0,first:0,flag:0,flat:0,folder:0,foobar:0,forensic_report:0,format:0,forward:0,found:0,fqdn:0,frame:0,friendli:0,from:0,front:0,full:0,further:0,gcm:0,gener:0,get:0,get_dmarc_reports_from_inbox:0,get_imap_cap:0,get_report_zip:0,git:0,github:0,give:0,given:0,glass:0,global:0,gmail:0,googl:0,gpg:0,graph:0,group:0,gzip:0,handl:0,has:0,have:0,header:0,header_from:0,healthcar:0,hec:0,hec_index:0,hec_token:0,here:0,high:0,highli:0,host:0,hostnam:0,hover:0,htpasswd:0,http2:0,http:0,httpasswd:0,human:0,human_timestamp:0,human_timestamp_to_datetim:0,human_timestamp_to_timestamp:0,icon:0,identifi:0,idl:0,imap:0,imapcli:0,imaperror:0,improv:0,inbox:0,includ:0,includesubdomain:0,incom:0,index:0,industri:0,inform:0,input:0,input_:0,insid:0,instanc:0,instead:0,invalid:0,invalidaggregatereport:0,invaliddmarcreport:0,invalidforensicreport:0,ip_address:0,issu:0,its:0,join:0,journalctl:0,jre:0,just:0,kei:0,keyout:0,kibana_saved_object:0,kind:0,know:0,known:0,later:0,latest:0,leak:0,least:0,leav:0,left:0,legitim:0,level:0,libemail:0,like:0,line:0,link:0,linux:0,list:0,listen:0,local:0,localhost:0,locat:0,log:0,login:0,look:0,lot:0,maco:0,magnifi:0,mai:0,mail:0,mail_from:0,mail_to:0,mailbox:0,mailto:0,main:0,malici:0,manag:0,market:0,match:0,max:0,mechan:0,mention:0,menu:0,messag:0,mfrom:0,microsoft:0,might:0,minut:0,mkdir:0,modern:0,modul:0,more:0,most:0,mous:0,move:0,move_support:0,msg:0,msgconvert:0,multi:0,must:0,name:0,nameserv:0,nano:0,need:0,net:0,network:0,newest:0,newkei:0,newli:0,next:0,nginx:0,node:0,none:0,norepli:0,normal:0,nosniff:0,notabl:0,now:0,number:0,object:0,observ:0,occur:0,off:0,office365:0,often:0,oing_from:0,old:0,older:0,oldest:0,onc:0,ondmarc:0,one:0,onli:0,onlin:0,openjdk:0,openssl:0,opt:0,ordereddict:0,org:0,org_email:0,org_extra_contact_info:0,org_nam:0,organ:0,origin:0,other:0,our:0,out:0,outdat:0,outg:0,outgo:0,outgoing_attach:0,outgoing_from:0,outgoing_host:0,outgoing_messag:0,outgoing_password:0,outgoing_port:0,outgoing_ssl:0,outgoing_subject:0,outgoing_to:0,outgoing_us:0,outlook:0,output_directori:0,over:0,overrid:0,overwrit:0,own:0,pack:0,packag:0,page:0,paramet:0,parent:0,pars:0,parse_aggregate_report_fil:0,parse_aggregate_report_xml:0,parse_forensic_report:0,parse_report_email:0,parse_report_fil:0,parsed_aggregate_reports_to_csv:0,parsed_forensic_reports_to_csv:0,parser:0,parsererror:0,part:0,particular:0,particularli:0,pass:0,passag:0,password:0,patch:0,path:0,pattern:0,pct:0,percentag:0,perl:0,permiss:0,pie:0,pip3:0,pip:0,place:0,plain:0,pleas:0,plu:0,polici:0,policy_evalu:0,policy_override_com:0,policy_override_reason:0,policy_publish:0,poly1305:0,port:0,posit:0,possibl:0,prefix:0,preload:0,premad:0,previou:0,previous:0,print:0,privaci:0,process:0,produc:0,program:0,project:0,prompt:0,provid:0,proxi:0,proxy_add_x_forwarded_for:0,proxy_pass:0,proxy_set_head:0,publicli:0,publish:0,python3:0,python:0,queri:0,rais:0,readabl:0,real:0,realli:0,reason:0,receiv:0,recipi:0,recogn:0,regardless:0,regul:0,regulatori:0,relai:0,relat:0,releas:0,reli:0,reload:0,remain:0,remote_addr:0,remov:0,report_id:0,report_metadata:0,report_typ:0,reports_fold:0,req:0,request:0,request_uri:0,requir:0,resolv:0,respons:0,restart:0,restartsec:0,restor:0,result:0,reus:0,revers:0,reverse_dn:0,review:0,rfc:0,right:0,root:0,rsa:0,rua:0,ruf:0,rule:0,same:0,sameorigin:0,sample_headers_onli:0,save:0,save_aggregate_report_to_elasticsearch:0,save_forensic_report_to_elasticsearch:0,save_output:0,schema:0,scope:0,search:0,second:0,secur:0,see:0,segment:0,select:0,selector:0,self:0,send:0,sensit:0,sent:0,separ:0,server:0,session:0,set:0,set_host:0,sha256:0,sha384:0,share:0,should:0,show:0,shown:0,shv:0,side:0,sign:0,signatur:0,silent:0,similar:0,simpl:0,simpli:0,singl:0,sister:0,site:0,situat:0,skip:0,smtp:0,smtperror:0,solut:0,some:0,someon:0,sometim:0,sort:0,source_base_domain:0,source_countri:0,source_ip_address:0,source_reverse_dn:0,specif:0,specifi:0,speed:0,spf_align:0,spf_domain:0,spf_result:0,spf_scope:0,splunk:0,spoof:0,ssl:0,ssl_certif:0,ssl_certificate_kei:0,ssl_cipher:0,ssl_context:0,ssl_prefer_server_ciph:0,ssl_protocol:0,ssl_session_cach:0,ssl_session_ticket:0,ssl_session_timeout:0,stabl:0,standard:0,start:0,starttl:0,statu:0,still:0,store:0,str:0,strict:0,string:0,structur:0,subdomain:0,subject:0,subsidiari:0,substitut:0,sudo:0,suffix:0,suggest:0,suit:0,suppli:0,symlink:0,system:0,systemctl:0,tab:0,tag:0,target:0,tee:0,tell:0,temporari:0,text:0,tgs:0,thei:0,theirs:0,them:0,thi:0,those:0,three:0,through:0,time:0,timeout:0,timestamp:0,tld:0,tlsv1:0,token:0,top:0,tracker:0,transpar:0,transport:0,trust:0,tweak:0,two:0,type:0,ubuntu:0,uncom:0,under:0,underneath:0,understand:0,uninstal:0,unit:0,unix:0,updat:0,upgrad:0,upper:0,uri:0,url:0,usag:0,use:0,use_ssl:0,used:0,useful:0,user:0,usernam:0,usr:0,util:0,valu:0,vendor:0,venv:0,veri:0,verif:0,version:0,vew:0,view:0,virtualenv:0,visit:0,volum:0,vulner:0,wai:0,wait:0,want:0,wantedbi:0,watch:0,watch_inbox:0,watcher:0,web:0,webmail:0,well:0,were:0,wget:0,when:0,whenev:0,where:0,wherea:0,which:0,who:0,why:0,wide:0,wiki:0,window:0,without:0,work:0,worst:0,would:0,write:0,www:0,x509:0,xml:0,xml_schema:0,yahoo:0,yet:0,you:0,your:0,yyyi:0,zip:0},titles:["parsedmarc documentation - Open source DMARC report analyzer and visualizer"],titleterms:{DNS:0,Using:0,aggreg:0,align:0,analyz:0,api:0,bug:0,cli:0,csv:0,dashboard:0,depend:0,dkim:0,dmarc:0,document:0,elast:0,elasticsearch:0,featur:0,forens:0,guid:0,help:0,indic:0,instal:0,json:0,kibana:0,multipl:0,open:0,option:0,output:0,parsedmarc:0,perform:0,pypy3:0,record:0,report:0,resourc:0,run:0,sampl:0,sender:0,servic:0,sourc:0,spf:0,summari:0,support:0,systemd:0,tabl:0,test:0,using:0,valid:0,visual:0,what:0,won:0}})
\ No newline at end of file
+Search.setIndex({docnames:["index"],envversion:55,filenames:["index.rst"],objects:{"":{parsedmarc:[0,0,0,"-"]},"parsedmarc.elastic":{AlreadySaved:[0,1,1,""],create_indexes:[0,2,1,""],save_aggregate_report_to_elasticsearch:[0,2,1,""],save_forensic_report_to_elasticsearch:[0,2,1,""],set_hosts:[0,2,1,""]},parsedmarc:{IMAPError:[0,1,1,""],InvalidAggregateReport:[0,1,1,""],InvalidDMARCReport:[0,1,1,""],InvalidForensicReport:[0,1,1,""],ParserError:[0,1,1,""],SMTPError:[0,1,1,""],elastic:[0,0,0,"-"],email_results:[0,2,1,""],extract_xml:[0,2,1,""],get_dmarc_reports_from_inbox:[0,2,1,""],get_imap_capabilities:[0,2,1,""],get_report_zip:[0,2,1,""],human_timestamp_to_datetime:[0,2,1,""],human_timestamp_to_timestamp:[0,2,1,""],parse_aggregate_report_file:[0,2,1,""],parse_aggregate_report_xml:[0,2,1,""],parse_forensic_report:[0,2,1,""],parse_report_email:[0,2,1,""],parse_report_file:[0,2,1,""],parsed_aggregate_reports_to_csv:[0,2,1,""],parsed_forensic_reports_to_csv:[0,2,1,""],save_output:[0,2,1,""],watch_inbox:[0,2,1,""]}},objnames:{"0":["py","module","Python module"],"1":["py","exception","Python exception"],"2":["py","function","Python function"]},objtypes:{"0":"py:module","1":"py:exception","2":"py:function"},terms:{"50m":0,"break":0,"byte":0,"case":0,"default":0,"float":0,"function":0,"import":0,"int":0,"long":0,"new":0,"null":0,"public":0,"return":0,"switch":0,"true":0,"while":0,For:0,OLE:0,TLS:0,That:0,The:0,Then:0,These:0,Use:0,With:0,_input:0,abl:0,about:0,abov:0,access:0,account:0,acm:0,across:0,actual:0,add:0,add_head:0,address:0,addresse:0,adkim:0,administr:0,adsl:0,aes128:0,aes256:0,after:0,against:0,agari:0,age:0,aggregate_report:0,all:0,along:0,alreadysav:0,also:0,alter:0,altern:0,alwai:0,ani:0,anoth:0,answer:0,apache2:0,appear:0,append:0,appendix:0,apt:0,archiv:0,archive_fold:0,argument:0,arriv:0,arrival_d:0,artifact:0,ask:0,aspf:0,attach:0,attachment_filenam:0,auth_bas:0,auth_basic_user_fil:0,auth_result:0,authent:0,author:0,autodetect:0,avail:0,avoid:0,b2c:0,base:0,base_domain:0,basic:0,becaus:0,been:0,begin_d:0,bellsouth:0,below:0,best:0,between:0,bin:0,bodi:0,bool:0,brand:0,busi:0,call:0,callback:0,can:0,capabl:0,caus:0,center:0,cert:0,certif:0,chacha20:0,chang:0,chart:0,check:0,checkdmarc:0,chines:0,chmod:0,chown:0,click:0,cloudflar:0,collect:0,collector:0,com:0,come:0,comma:0,command:0,commerci:0,common:0,compress:0,configur:0,connect:0,consid:0,consist:0,consolid:0,consum:0,contact:0,contain:0,content:0,context:0,control:0,convert:0,copi:0,correctli:0,could:0,count:0,countri:0,crash:0,creat:0,create_index:0,crt:0,csr:0,current:0,custom:0,daemon:0,dai:0,daili:0,data:0,date_rang:0,datetim:0,deb:0,debian:0,debug:0,delet:0,demystifi:0,descript:0,detail:0,develop:0,dict:0,differ:0,directli:0,directori:0,disabl:0,displai:0,disposit:0,dkim_align:0,dkim_domain:0,dkim_result:0,dkim_selector:0,dkm:0,dmarc_aggreg:0,dmarc_forens:0,dmarcian:0,dns_timeout:0,doe:0,domain:0,domainawar:0,don:0,done:0,down:0,download:0,draft:0,each:0,earlier:0,ecdh:0,ecdsa:0,echo:0,edit:0,editor:0,elasticsearch_host:0,elasticsearch_index_prefix:0,elasticsearch_index_suffix:0,els:0,email:0,email_result:0,enabl:0,encount:0,end:0,end_dat:0,ensur:0,entir:0,envelop:0,envelope_from:0,envelope_to:0,error:0,especi:0,etc:0,even:0,event:0,everi:0,exampl:0,exampleus:0,except:0,execstart:0,exist:0,exit:0,extract:0,extract_xml:0,fail:0,failur:0,fals:0,feedback:0,feedback_report:0,fetch:0,few:0,field:0,file:0,file_path:0,filenam:0,fill:0,filter:0,financ:0,find:0,first:0,flag:0,flat:0,folder:0,follow:0,foobar:0,forensic_report:0,format:0,forward:0,found:0,fqdn:0,frame:0,friendli:0,from:0,front:0,full:0,further:0,gcm:0,gener:0,get:0,get_dmarc_reports_from_inbox:0,get_imap_cap:0,get_report_zip:0,git:0,github:0,give:0,given:0,glass:0,global:0,gmail:0,googl:0,gpg:0,graph:0,group:0,gzip:0,handl:0,has:0,have:0,header:0,header_from:0,healthcar:0,hec:0,hec_index:0,hec_token:0,here:0,high:0,highli:0,host:0,hostnam:0,hover:0,htpasswd:0,http2:0,http:0,httpasswd:0,human:0,human_timestamp:0,human_timestamp_to_datetim:0,human_timestamp_to_timestamp:0,icon:0,identifi:0,idl:0,imap:0,imapcli:0,imaperror:0,improv:0,inbox:0,includ:0,includesubdomain:0,incom:0,index:0,industri:0,inform:0,input:0,input_:0,insid:0,instanc:0,instead:0,invalid:0,invalidaggregatereport:0,invaliddmarcreport:0,invalidforensicreport:0,ip_address:0,issu:0,its:0,join:0,journalctl:0,jre:0,just:0,kei:0,keyout:0,kibana_saved_object:0,kind:0,know:0,known:0,later:0,latest:0,leak:0,least:0,leav:0,left:0,legitim:0,level:0,libemail:0,like:0,line:0,link:0,linux:0,list:0,listen:0,local:0,localhost:0,locat:0,log:0,login:0,look:0,lot:0,maco:0,magnifi:0,mai:0,mail:0,mail_from:0,mail_to:0,mailbox:0,mailto:0,main:0,malici:0,manag:0,market:0,match:0,max:0,mechan:0,mention:0,menu:0,messag:0,mfrom:0,microsoft:0,might:0,minut:0,mkdir:0,modern:0,modul:0,more:0,most:0,mous:0,move:0,move_support:0,msg:0,msgconvert:0,multi:0,must:0,name:0,nameserv:0,nano:0,need:0,net:0,network:0,newest:0,newkei:0,newli:0,next:0,nginx:0,node:0,none:0,norepli:0,normal:0,nosniff:0,notabl:0,now:0,number:0,object:0,observ:0,occur:0,occurr:0,off:0,office365:0,often:0,oing_from:[],old:0,older:0,oldest:0,onc:0,ondmarc:0,one:0,onli:0,onlin:0,openjdk:0,openssl:0,opt:0,ordereddict:0,org:0,org_email:0,org_extra_contact_info:0,org_nam:0,organ:0,origin:0,other:0,our:0,out:0,outdat:0,outg:[],outgo:0,outgoing_attach:0,outgoing_from:0,outgoing_host:0,outgoing_messag:0,outgoing_password:0,outgoing_port:0,outgoing_ssl:0,outgoing_subject:0,outgoing_to:0,outgoing_us:0,outlook:0,output_directori:0,over:0,overrid:0,overwrit:0,own:0,pack:0,packag:0,page:0,paramet:0,parent:0,pars:0,parse_aggregate_report_fil:0,parse_aggregate_report_xml:0,parse_forensic_report:0,parse_report_email:0,parse_report_fil:0,parsed_aggregate_reports_to_csv:0,parsed_forensic_reports_to_csv:0,parser:0,parsererror:0,part:0,particular:0,particularli:0,pass:0,passag:0,password:0,past:0,patch:0,path:0,pattern:0,pct:0,percentag:0,perl:0,permiss:0,pie:0,pip3:0,pip:0,place:0,plain:0,pleas:0,plu:0,polici:0,policy_evalu:0,policy_override_com:0,policy_override_reason:0,policy_publish:0,poly1305:0,port:0,posit:0,possibl:0,prefix:0,preload:0,premad:0,previou:0,previous:0,print:0,privaci:0,process:0,produc:0,program:0,project:0,prompt:0,provid:0,proxi:0,proxy_add_x_forwarded_for:0,proxy_pass:0,proxy_set_head:0,publicli:0,publish:0,python3:0,python:0,queri:0,rais:0,readabl:0,real:0,realli:0,reason:0,receiv:0,recipi:0,recogn:0,regardless:0,regul:0,regulatori:0,relai:0,relat:0,releas:0,reli:0,reload:0,remain:0,remote_addr:0,remov:0,report_id:0,report_metadata:0,report_typ:0,reports_fold:0,repositori:0,req:0,request:0,request_uri:0,requir:0,resolv:0,respons:0,restart:0,restartsec:0,restor:0,result:0,reus:0,revers:0,reverse_dn:0,review:0,rfc:0,right:0,root:0,rsa:0,rua:0,ruf:0,rule:0,same:0,sameorigin:0,sample_headers_onli:0,save:0,save_aggregate_report_to_elasticsearch:0,save_forensic_report_to_elasticsearch:0,save_output:0,schema:0,scope:0,search:0,second:0,secur:0,see:0,segment:0,select:0,selector:0,self:0,send:0,sensit:0,sent:0,separ:0,server:0,session:0,set:0,set_host:0,sha256:0,sha384:0,share:0,should:0,show:0,shown:0,shv:0,side:0,sign:0,signatur:0,silent:0,similar:0,simpl:0,simpli:0,singl:0,sister:0,site:0,situat:0,skip:0,smtp:0,smtperror:0,solut:0,some:0,someon:0,sometim:0,sort:0,source_base_domain:0,source_countri:0,source_ip_address:0,source_reverse_dn:0,specif:0,specifi:0,speed:0,spf_align:0,spf_domain:0,spf_result:0,spf_scope:0,splunk:[],spoof:0,ssl:0,ssl_certif:0,ssl_certificate_kei:0,ssl_cipher:0,ssl_context:0,ssl_prefer_server_ciph:0,ssl_protocol:0,ssl_session_cach:0,ssl_session_ticket:0,ssl_session_timeout:0,stabl:0,standard:0,start:0,starttl:0,statu:0,still:0,store:0,str:0,strict:0,string:0,structur:0,subdomain:0,subject:0,subsidiari:0,substitut:0,sudo:0,suffix:0,suggest:0,suit:0,suppli:0,symlink:0,system:0,systemctl:0,tab:0,tag:0,target:0,tee:0,tell:0,temporari:0,text:0,tgs:[],thei:0,theirs:0,them:0,thi:0,those:0,three:0,through:0,time:0,timeout:0,timestamp:0,tld:0,tlsv1:0,token:0,top:0,tracker:0,transpar:0,transport:0,trust:0,tweak:0,two:0,type:0,ubuntu:0,uncom:0,under:0,underneath:0,understand:0,uninstal:0,unit:0,unix:0,updat:0,upgrad:0,upper:0,uri:0,url:0,usag:0,use:0,use_ssl:0,used:0,useful:0,user:0,usernam:0,usr:0,util:0,valu:0,vendor:0,venv:0,veri:0,verif:0,version:0,vew:0,view:0,virtualenv:0,visit:0,volum:0,vulner:0,wai:0,wait:0,want:0,wantedbi:0,watch:0,watch_inbox:0,watcher:0,web:0,webmail:0,well:0,were:0,wget:0,when:0,whenev:0,where:0,wherea:0,which:0,who:0,why:0,wide:0,wiki:0,window:0,without:0,work:0,worst:0,would:0,write:0,www:0,x509:0,xml:0,xml_schema:0,yahoo:0,yet:0,you:0,your:0,yyyi:0,zip:0},titles:["parsedmarc documentation - Open source DMARC report analyzer and visualizer"],titleterms:{DNS:0,Using:0,aggreg:0,align:0,analyz:0,api:0,bug:0,cli:0,csv:0,dashboard:0,depend:0,dkim:0,dmarc:0,document:0,elast:0,elasticsearch:0,featur:0,forens:0,guid:0,help:0,indic:0,instal:0,json:0,kibana:0,multipl:0,open:0,option:0,output:0,parsedmarc:0,perform:0,pypy3:0,record:0,report:0,resourc:0,run:0,sampl:0,sender:0,servic:0,sourc:0,spf:0,splunk:0,summari:0,support:0,systemd:0,tabl:0,test:0,using:0,valid:0,visual:0,what:0,won:0}})
\ No newline at end of file