amorfo77/parsedmarc
1
0
Fork 0
mirror of https://github.com/domainaware/parsedmarc.git synced 2026-07-07 01:05:09 +00:00
Code Issues Projects Releases Wiki Activity

Only save to Splunk when there are things to save

Browse Source
This commit is contained in:
Sean Whalen
2018-09-25 15:50:53 -04:00
parent caf6cd1872
commit c9177f3342
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
parsedmarc/splunk.py
+11 -5
View File
@@ -57,6 +57,9 @@ class HECClient(object):
if type(aggregate_reports) == dict:
aggregate_reports = [aggregate_reports]
if len(aggregate_reports) < 1:
return
data = self._common_data.copy()
json_str = ""
for report in aggregate_reports:
@@ -101,20 +104,23 @@ class HECClient(object):
if response["code"] != 0:
raise SplunkError(response["text"])
def save_forensic_reports_to_splunk(self, aggregate_reports):
def save_forensic_reports_to_splunk(self, forensic_reports):
"""
Saves forensic DMARC reports to Splunk
Args:
aggregate_reports (list): A list of forensic report dictionaries
forensic_reports (list): A list of forensic report dictionaries
to save in Splunk
"""
if type(aggregate_reports) == dict:
aggregate_reports = [aggregate_reports]
if type(forensic_reports) == dict:
forensic_reports = [forensic_reports]
if len(forensic_reports) < 1:
return
json_str = ""
for report in aggregate_reports:
for report in forensic_reports:
data = self._common_data.copy()
data["sourcetype"] = "dmarc:forensic"
data["event"] = report.copy()