From a1e8506d426e89ad549ef3c21ad237530f91f0c5 Mon Sep 17 00:00:00 2001 From: Sean Whalen Date: Thu, 11 Oct 2018 16:32:09 -0400 Subject: [PATCH] Process email samples with missing dates --- parsedmarc/elastic.py | 6 ++++-- parsedmarc/utils.py | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/parsedmarc/elastic.py b/parsedmarc/elastic.py index 63718928..b21f20b4 100644 --- a/parsedmarc/elastic.py +++ b/parsedmarc/elastic.py @@ -307,8 +307,10 @@ def save_forensic_report_to_elasticsearch(forensic_report, """ logger.debug("Saving forensic report to Elasticsearch") forensic_report = forensic_report.copy() - sample_date = forensic_report["parsed_sample"]["date"] - sample_date = human_timestamp_to_datetime(sample_date) + sample_date = None + if forensic_report["parsed_sample"]["date"] is not None: + sample_date = forensic_report["parsed_sample"]["date"] + sample_date = human_timestamp_to_datetime(sample_date) original_headers = forensic_report["parsed_sample"]["headers"] headers = OrderedDict() for original_header in original_headers: diff --git a/parsedmarc/utils.py b/parsedmarc/utils.py index 724d7d61..4a747962 100644 --- a/parsedmarc/utils.py +++ b/parsedmarc/utils.py @@ -399,6 +399,10 @@ def parse_email(data): " ") parsed_email["from"] = parse_email_address(parsed_email["from"][0]) + if "date" in parsed_email: + parsed_email["date"] = parsed_email["date"].replace("T", " ") + else: + parsed_email["date"] = None if "reply_to" in parsed_email: parsed_email["reply_to"] = list(map(lambda x: parse_email_address(x), parsed_email["reply_to"]))