diff --git a/CHANGELOG.md b/CHANGELOG.md index 3a2cef7b..0af49aa7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -31,6 +31,7 @@ Forensic reports have been renamed to failure reports throughout the project to - Old function/type names preserved as aliases: `parse_forensic_report = parse_failure_report`, `ForensicReport = FailureReport`, etc. - CLI config accepts both old (`save_forensic`, `forensic_topic`) and new keys (`save_failure`, `failure_topic`) +- IMAP archive subfolder name is intentionally kept as `Forensic` (under `archive_folder`) so existing deployments don't end up with a split archive across `Forensic/` and `Failure/`. - RFC 7489 reports parse with `None` for DMARCbis-only fields - **Updated dashboards with queries are backward compatible**: queries match data indexed under both old (`dmarc_forensic*` / `dmarc:forensic`) and new (`dmarc_failure*` / `dmarc:failure`) names, so dashboards show data from before and after the rename: - **OpenSearch Dashboards**: Index pattern uses `dmarc_f*` to match both `dmarc_forensic*` and `dmarc_failure*` diff --git a/docs/source/usage.md b/docs/source/usage.md index 5d5a56fd..576d3890 100644 --- a/docs/source/usage.md +++ b/docs/source/usage.md @@ -651,7 +651,7 @@ imports more predictable: - Use `mailbox.since` to process reports in smaller time windows such as `1d`, `7d`, or another interval that fits the backlog. This makes it easier to catch up incrementally instead of loading an entire mailbox history in one run. -- Set `strip_attachment_payloads = True` when forensic reports contain large +- Set `strip_attachment_payloads = True` when failure reports contain large attachments and you do not need to retain the raw payloads in the parsed output. - Prefer running parsedmarc separately from Elasticsearch or OpenSearch, or diff --git a/parsedmarc/cli.py b/parsedmarc/cli.py index 95da459d..3ba75517 100644 --- a/parsedmarc/cli.py +++ b/parsedmarc/cli.py @@ -1630,10 +1630,10 @@ def _main(): arg_parser.add_argument( "file_path", nargs="*", - help="one or more paths to aggregate or forensic " + help="one or more paths to aggregate or failure " "report files, emails, or mbox files'", ) - strip_attachment_help = "remove attachment payloads from forensic report output" + strip_attachment_help = "remove attachment payloads from failure report output" arg_parser.add_argument( "--strip-attachment-payloads", help=strip_attachment_help, action="store_true" )