Process email samples with missing dates

This commit is contained in:
Sean Whalen
2018-10-11 16:32:09 -04:00
parent 0a2aea0a7a
commit a1e8506d42
2 changed files with 8 additions and 2 deletions
+4 -2
View File
@@ -307,8 +307,10 @@ def save_forensic_report_to_elasticsearch(forensic_report,
"""
logger.debug("Saving forensic report to Elasticsearch")
forensic_report = forensic_report.copy()
sample_date = forensic_report["parsed_sample"]["date"]
sample_date = human_timestamp_to_datetime(sample_date)
sample_date = None
if forensic_report["parsed_sample"]["date"] is not None:
sample_date = forensic_report["parsed_sample"]["date"]
sample_date = human_timestamp_to_datetime(sample_date)
original_headers = forensic_report["parsed_sample"]["headers"]
headers = OrderedDict()
for original_header in original_headers:
+4
View File
@@ -399,6 +399,10 @@ def parse_email(data):
" ")
parsed_email["from"] = parse_email_address(parsed_email["from"][0])
if "date" in parsed_email:
parsed_email["date"] = parsed_email["date"].replace("T", " ")
else:
parsed_email["date"] = None
if "reply_to" in parsed_email:
parsed_email["reply_to"] = list(map(lambda x: parse_email_address(x),
parsed_email["reply_to"]))