amorfo77/parsedmarc
1
0
Fork 0
mirror of https://github.com/domainaware/parsedmarc.git synced 2026-08-11 09:53:18 +00:00
Code Issues Projects Releases Wiki Activity

Remove implicit wildcards from Splunk dashboards

Browse Source
This commit is contained in:
Sean Whalen
2018-09-28 00:08:49 -04:00
parent db2625fff9
commit c5e44327b3
2 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
splunk/dmarc_aggregate_dashboard.xml
+13 -13
View File
@@ -76,7 +76,7 @@
<title>SPF alignment</title>
<chart>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by spf_aligned</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | chart sum(message_count) by spf_aligned</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -88,7 +88,7 @@
<title>DKIM alignment</title>
<chart>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by dkim_aligned</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | chart sum(message_count) by dkim_aligned</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -101,7 +101,7 @@
<title>Passed DMARC</title>
<chart>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by passed_dmarc</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | chart sum(message_count) by passed_dmarc</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -115,7 +115,7 @@
<title>Reporting organizations</title>
<table>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by org_name | sort -sum(message_count)</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | chart sum(message_count) by org_name | sort -sum(message_count)</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -129,7 +129,7 @@
<title>Message sources by reverse DNS</title>
<table>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | fillnull value="none" | chart sum(message_count) by source_base_domain | sort -sum(message_count)</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | fillnull value="none" | chart sum(message_count) by source_base_domain | sort -sum(message_count)</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -143,7 +143,7 @@
<title>Message volume by header from</title>
<table>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by header_from | sort -sum(message_count)</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | chart sum(message_count) by header_from | sort -sum(message_count)</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -159,7 +159,7 @@
<title>DMARC passage over time</title>
<chart>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by _time,passed_dmarc</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | chart sum(message_count) by _time,passed_dmarc</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
@@ -180,7 +180,7 @@
<title>Message disposition over time</title>
<chart>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by _time,disposition</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | chart sum(message_count) by _time,disposition</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -196,7 +196,7 @@
<title>Message volume by source country</title>
<map>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | iplocation source_ip_address | stats count by Country | geom geo_countries featureIdField="Country"</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | iplocation source_ip_address | stats count by Country | geom geo_countries featureIdField="Country"</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -211,7 +211,7 @@
<title>Source countries</title>
<table>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | stats sum(message_count) by source_country | sort -sum(message_count)</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | stats sum(message_count) by source_country | sort -sum(message_count)</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -229,7 +229,7 @@
<title>Message sources by IP address</title>
<table>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | stats sum(message_count) by source_ip_address,source_reverse_dns,source_base_domain,source_country | sort -sum(message_count)</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | stats sum(message_count) by source_ip_address,source_reverse_dns,source_base_domain,source_country | sort -sum(message_count)</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -245,7 +245,7 @@
<title>SPF alignment details</title>
<table>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | fillnull value="none" | stats sum(message_count) by header_from,envelope_from,spf_results{}.result,spf_aligned,source_base_domain | sort -sum(message_count)</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | fillnull value="none" | stats sum(message_count) by header_from,envelope_from,spf_results{}.result,spf_aligned,source_base_domain | sort -sum(message_count)</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -261,7 +261,7 @@
<title>DKIM alignment details</title>
<table>
<search>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | fillnull value="none" | stats sum(message_count) by header_from,dkim_results{}.selector,dkim_results{}.domain,dkim_results{}.result,dkim_aligned,source_base_domain | sort -sum(message_count)</query>
<query>index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ dkim_results{}.selector=$dkim_selector$ dkim_results{}.domain=$dkim_domain$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_country=$source_country$ | fillnull value="none" | stats sum(message_count) by header_from,dkim_results{}.selector,dkim_results{}.domain,dkim_results{}.result,dkim_aligned,source_base_domain | sort -sum(message_count)</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
splunk/dmarc_forensic_dashboard.xml
+4 -4
View File
@@ -38,7 +38,7 @@
<title>Forensic samples</title>
<table>
<search>
<query>index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=*$header_from$* parsed_sample.headers.To=*$header_to$* parsed_sample.headers.Subject=*$header_subject$* source.ip_address=*$source_ip_address$* source.reverse_dns=*$source_reverse_dns$* source.country=$source_country$ | fillnull value="none" | stats count by _time,parsed_sample.headers.From,parsed_sample.headers.To,parsed_sample.headers.Reply-To,parsed_sample.headers.Subject | sort -_time</query>
<query>index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=$header_from$ parsed_sample.headers.To=$header_to$ parsed_sample.headers.Subject=$header_subject$ source.ip_address=$source_ip_address$ source.reverse_dns=$source_reverse_dns$ source.country=$source_country$ | fillnull value="none" | stats count by _time,parsed_sample.headers.From,parsed_sample.headers.To,parsed_sample.headers.Reply-To,parsed_sample.headers.Subject | sort -_time</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -55,7 +55,7 @@
<title>Forensic samples by country</title>
<map>
<search>
<query>index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=*$header_from$* parsed_sample.headers.To=*$header_to$* parsed_sample.headers.Subject=*$header_subject$* source.ip_address=*$source_ip_address$* source.reverse_dns=*$source_reverse_dns$* source.country=$source_country$ | iplocation source.ip_address | stats count by Country | geom geo_countries featureIdField="Country"</query>
<query>index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=$header_from$ parsed_sample.headers.To=$header_to$ parsed_sample.headers.Subject=$header_subject$ source.ip_address=$source_ip_address$ source.reverse_dns=$source_reverse_dns$ source.country=$source_country$ | iplocation source.ip_address | stats count by Country | geom geo_countries featureIdField="Country"</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -70,7 +70,7 @@
<title>Forensic samples by IP address</title>
<table>
<search>
<query>index="email" sourcetype="dmarc:forensic" sourcetype="dmarc:forensic" parsed_sample.headers.From=*$header_from$* parsed_sample.headers.To=*$header_to$* parsed_sample.headers.Subject=*$header_subject$* source.ip_address=*$source_ip_address$* source.reverse_dns=*$source_reverse_dns$* source.country=$source_country$ | fillnull value="none" | iplocation source.ip_address | stats count by source.ip_address,source.reverse_dns,Country | sort -count</query>
<query>index="email" sourcetype="dmarc:forensic" sourcetype="dmarc:forensic" parsed_sample.headers.From=$header_from$ parsed_sample.headers.To=$header_to$ parsed_sample.headers.Subject=$header_subject$ source.ip_address=$source_ip_address$ source.reverse_dns=$source_reverse_dns$ source.country=$source_country$ | fillnull value="none" | iplocation source.ip_address | stats count by source.ip_address,source.reverse_dns,Country | sort -count</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
@@ -84,7 +84,7 @@
<title>Forensic samples by country ISO code</title>
<table>
<search>
<query>index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=*$header_from$* parsed_sample.headers.To=*$header_to$* parsed_sample.headers.Subject=*$header_subject$* source.ip_address=*$source_ip_address$* source.reverse_dns=*$source_reverse_dns$* source.country=$source_country$ | stats count by source.country | sort - count</query>
<query>index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=$header_from$ parsed_sample.headers.To=$header_to$ parsed_sample.headers.Subject=$header_subject$ source.ip_address=$source_ip_address$ source.reverse_dns=$source_reverse_dns$ source.country=$source_country$ | stats count by source.country | sort - count</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>