diff --git a/_modules/index.html b/_modules/index.html index bd8b1d6d..5ac9f1b6 100644 --- a/_modules/index.html +++ b/_modules/index.html @@ -5,14 +5,14 @@ - Overview: module code — parsedmarc 10.2.2 documentation + Overview: module code — parsedmarc 10.2.4 documentation - + diff --git a/_modules/parsedmarc.html b/_modules/parsedmarc.html index 880bc945..cbb43da4 100644 --- a/_modules/parsedmarc.html +++ b/_modules/parsedmarc.html @@ -5,14 +5,14 @@ - parsedmarc — parsedmarc 10.2.2 documentation + parsedmarc — parsedmarc 10.2.4 documentation - + @@ -1668,6 +1668,27 @@ f.strip() for f in parsed_report["auth_failure"].split(",") if f.strip() ] + # Feedback-Type is REQUIRED per RFC 5965 §3.1, but some gateways + # (e.g. Exim/cPanel-based ones that send a plain-text summary without + # a machine-readable message/feedback-report part) omit it. The + # Elasticsearch/OpenSearch outputs require the key, so default it + # instead of dropping the report there (see issue #332). + if "feedback_type" not in parsed_report: + logger.warning( + "Failure report missing required 'Feedback-Type' field " + "(RFC 5965 §3.1); defaulting to 'auth-failure'" + ) + parsed_report["feedback_type"] = "auth-failure" + + # Authentication-Results is likewise REQUIRED per RFC 6591 §3.1 and + # required by the Elasticsearch/OpenSearch outputs. + if "authentication_results" not in parsed_report: + logger.warning( + "Failure report missing required 'Authentication-Results' " + "field (RFC 6591 §3.1); defaulting to None" + ) + parsed_report["authentication_results"] = None + optional_fields = [ "original_envelope_id", "dkim_domain", @@ -2963,6 +2984,37 @@ +def _build_report_email_content( + results: ParsingResults, + *, + subject: str | None = None, + attachment_filename: str | None = None, + message: str | None = None, +) -> tuple[str, str, list[tuple[str, bytes]]]: + """Builds the subject, plain-text body, and zip attachment shared by + every report-summary email transport. + + Returns: + A ``(subject, plain_message, attachments)`` tuple. + """ + date_string = datetime.now().strftime("%Y-%m-%d") + if attachment_filename: + if not attachment_filename.lower().endswith(".zip"): + attachment_filename += ".zip" + filename = attachment_filename + else: + filename = "DMARC-{0}.zip".format(date_string) + + if subject is None: + subject = "DMARC results for {0}".format(date_string) + if message is None: + message = "DMARC results for {0}".format(date_string) + zip_bytes = get_report_zip(results) + attachments = [(filename, zip_bytes)] + + return subject, message, attachments + +
[docs] def email_results( @@ -3002,22 +3054,14 @@ message (str): Override the default plain text body """ logger.debug("Emailing report") - date_string = datetime.now().strftime("%Y-%m-%d") - if attachment_filename: - if not attachment_filename.lower().endswith(".zip"): - attachment_filename += ".zip" - filename = attachment_filename - else: - filename = "DMARC-{0}.zip".format(date_string) - assert isinstance(mail_to, list) - if subject is None: - subject = "DMARC results for {0}".format(date_string) - if message is None: - message = "DMARC results for {0}".format(date_string) - zip_bytes = get_report_zip(results) - attachments = [(filename, zip_bytes)] + subject, message, attachments = _build_report_email_content( + results, + subject=subject, + attachment_filename=attachment_filename, + message=message, + ) send_email( host, @@ -3037,6 +3081,59 @@ +
+[docs] +def email_results_via_msgraph( + results: ParsingResults, + connection: MSGraphConnection, + mail_to: list[str], + *, + mail_cc: list[str] | None = None, + mail_bcc: list[str] | None = None, + subject: str | None = None, + attachment_filename: str | None = None, + message: str | None = None, +) -> None: + """ + Emails parsing results as a zip file via an already-authenticated + Microsoft Graph mailbox connection (``/users/{mailbox}/sendMail``), + saving a copy to Sent Items. + + Args: + results (dict): Parsing results + connection (MSGraphConnection): An already-authenticated Microsoft + Graph mailbox connection + mail_to (list): A list of addresses to mail to + mail_cc (list): A list of addresses to CC + mail_bcc (list): A list addresses to BCC + subject (str): Overrides the default message subject + attachment_filename (str): Override the default attachment filename + message (str): Override the default plain text body + """ + logger.debug("Emailing report via Microsoft Graph") + + subject, message, attachments = _build_report_email_content( + results, + subject=subject, + attachment_filename=attachment_filename, + message=message, + ) + + # Graph derives the From header from the authenticated mailbox and + # ignores message_from; it's still passed for API parity with + # send_message()'s signature. + connection.send_message( + message_from=connection.mailbox_name or "", + message_to=mail_to, + message_cc=mail_cc, + message_bcc=mail_bcc, + subject=subject, + attachments=attachments, + plain_message=message, + )
+ + + # Backward-compatible aliases parse_forensic_report = parse_failure_report parsed_forensic_reports_to_csv_rows = parsed_failure_reports_to_csv_rows diff --git a/_modules/parsedmarc/elastic.html b/_modules/parsedmarc/elastic.html index 0caaf392..8082d6b4 100644 --- a/_modules/parsedmarc/elastic.html +++ b/_modules/parsedmarc/elastic.html @@ -5,14 +5,14 @@ - parsedmarc.elastic — parsedmarc 10.2.2 documentation + parsedmarc.elastic — parsedmarc 10.2.4 documentation - + @@ -84,10 +84,9 @@ from __future__ import annotations -from typing import Any +from typing import TYPE_CHECKING, Any -from elasticsearch.helpers import reindex -from elasticsearch_dsl import ( +from elasticsearch.dsl import ( Boolean, Date, Document, @@ -98,11 +97,11 @@ Keyword, Nested, Object, + Q, Search, Text, connections, ) -from elasticsearch_dsl.search import Q from parsedmarc import InvalidFailureReport from parsedmarc.log import logger @@ -129,11 +128,28 @@ class _PolicyOverride(InnerDoc): + # The elasticsearch.dsl 8.x type stubs use dataclass_transform and only + # surface dataclass-style annotated fields (``name: M[...] = + # mapped_field(...)``) as constructor parameters. This module declares + # fields the pre-8.x way (``name = Text()``), which the runtime fully + # supports via ObjectBase.__init__(**kwargs), so this TYPE_CHECKING-only + # declaration restores the real runtime signature for the type checker. + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + type = Text() comment = Text() class _PublishedPolicy(InnerDoc): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + domain = Text() adkim = Text() aspf = Text() @@ -147,6 +163,12 @@ class _DKIMResult(InnerDoc): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + domain = Text() selector = Text() result = Text() @@ -154,6 +176,12 @@ class _SPFResult(InnerDoc): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + domain = Text() scope = Text() results = Text() @@ -161,6 +189,12 @@ class _AggregateReportDoc(Document): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + class Index: name = "dmarc_aggregate" @@ -203,7 +237,7 @@ generator = Text() def add_policy_override(self, type_: str, comment: str): - self.policy_overrides.append(_PolicyOverride(type=type_, comment=comment)) # pyright: ignore[reportCallIssue] + self.policy_overrides.append(_PolicyOverride(type=type_, comment=comment)) def add_dkim_result( self, @@ -219,7 +253,7 @@ result=result, human_result=human_result, ) - ) # pyright: ignore[reportCallIssue] + ) def add_spf_result( self, @@ -235,7 +269,7 @@ result=result, human_result=human_result, ) - ) # pyright: ignore[reportCallIssue] + ) def save(self, **kwargs): # pyright: ignore[reportIncompatibleMethodOverride] self.passed_dmarc = False @@ -245,17 +279,35 @@ class _EmailAddressDoc(InnerDoc): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + display_name = Text() address = Text() class _EmailAttachmentDoc(Document): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + filename = Text() content_type = Text() sha256 = Text() class _FailureSampleDoc(InnerDoc): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + raw = Text() headers = Object() headers_only = Boolean() @@ -271,28 +323,34 @@ attachments = Nested(_EmailAttachmentDoc) def add_to(self, display_name: str, address: str): - self.to.append(_EmailAddressDoc(display_name=display_name, address=address)) # pyright: ignore[reportCallIssue] + self.to.append(_EmailAddressDoc(display_name=display_name, address=address)) def add_reply_to(self, display_name: str, address: str): self.reply_to.append( _EmailAddressDoc(display_name=display_name, address=address) - ) # pyright: ignore[reportCallIssue] + ) def add_cc(self, display_name: str, address: str): - self.cc.append(_EmailAddressDoc(display_name=display_name, address=address)) # pyright: ignore[reportCallIssue] + self.cc.append(_EmailAddressDoc(display_name=display_name, address=address)) def add_bcc(self, display_name: str, address: str): - self.bcc.append(_EmailAddressDoc(display_name=display_name, address=address)) # pyright: ignore[reportCallIssue] + self.bcc.append(_EmailAddressDoc(display_name=display_name, address=address)) def add_attachment(self, filename: str, content_type: str, sha256: str): self.attachments.append( _EmailAttachmentDoc( filename=filename, content_type=content_type, sha256=sha256 ) - ) # pyright: ignore[reportCallIssue] + ) class _FailureReportDoc(Document): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + class Index: name = "dmarc_failure" @@ -319,6 +377,12 @@ class _SMTPTLSFailureDetailsDoc(InnerDoc): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + result_type = Text() sending_mta_ip = Ip() receiving_mx_helo = Text() @@ -329,6 +393,12 @@ class _SMTPTLSPolicyDoc(InnerDoc): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + policy_domain = Text() policy_type = Text() policy_strings = Text() @@ -360,10 +430,16 @@ additional_information=additional_information_uri, failure_reason_code=failure_reason_code, ) - self.failure_details.append(_details) # pyright: ignore[reportCallIssue] + self.failure_details.append(_details) class _SMTPTLSReportDoc(Document): + # TYPE_CHECKING __init__: see _PolicyOverride + if TYPE_CHECKING: + + def __init__(self, *args: Any, **kwargs: Any) -> None: + pass + class Index: name = "smtp_tls" @@ -402,7 +478,9 @@ Args: hosts (str | list[str]): A single hostname or URL, or list of hostnames or URLs - use_ssl (bool): Use an HTTPS connection to the server + use_ssl (bool): Controls the scheme prepended to any host that doesn't + already include one (``https://`` when True, ``http://`` when + False). Hosts that already carry a scheme are left unchanged. ssl_cert_path (str): Path to the certificate chain skip_certificate_verification (bool): Skip certificate verification username (str): The username to use for authentication @@ -419,9 +497,12 @@ _SERVERLESS = serverless if not isinstance(hosts, list): hosts = [hosts] - conn_params = {"hosts": hosts, "timeout": timeout} + scheme = "https://" if use_ssl else "http://" + normalized_hosts = [ + host if "://" in host else "{0}{1}".format(scheme, host) for host in hosts + ] + conn_params = {"hosts": normalized_hosts, "request_timeout": timeout} if use_ssl: - conn_params["use_ssl"] = True if ssl_cert_path: conn_params["ca_certs"] = ssl_cert_path if skip_certificate_verification: @@ -429,7 +510,7 @@ else: conn_params["verify_certs"] = True if username and password: - conn_params["http_auth"] = (username, password) + conn_params["basic_auth"] = (username, password) if api_key: conn_params["api_key"] = api_key connections.create_connection(**conn_params)
@@ -481,43 +562,21 @@ """ Updates index mappings + This is a no-op kept for API compatibility (``cli.py`` calls it on + startup). The only migration this function ever performed was + re-typing ``published_policy.fo`` from ``long`` to ``text``, which + applied exclusively to indices still carrying the legacy + Elasticsearch 6-era ``"doc"`` mapping type. The 8.x client can only + reach servers (Elasticsearch 8.x/9.x) whose indices were created on + Elasticsearch 7.x or later and are therefore typeless, so that + migration path is unreachable and has been removed. + Args: aggregate_indexes (list): A list of aggregate index names + (accepted for API compatibility; unused) failure_indexes (list): A list of failure index names - (accepted for API compatibility; no migrations are - currently needed for failure indexes) - """ - version = 2 - if aggregate_indexes is None: - aggregate_indexes = [] - for aggregate_index_name in aggregate_indexes: - if not Index(aggregate_index_name).exists(): - continue - aggregate_index = Index(aggregate_index_name) - doc = "doc" - fo_field = "published_policy.fo" - fo = "fo" - fo_mapping = aggregate_index.get_field_mapping(fields=[fo_field]) - fo_mapping = fo_mapping[list(fo_mapping.keys())[0]]["mappings"] - if doc not in fo_mapping: - continue - - fo_mapping = fo_mapping[doc][fo_field]["mapping"][fo] - fo_type = fo_mapping["type"] - if fo_type == "long": - new_index_name = "{0}-v{1}".format(aggregate_index_name, version) - body = { - "properties": { - "published_policy.fo": { - "type": "text", - "fields": {"keyword": {"type": "keyword", "ignore_above": 256}}, - } - } - } - Index(new_index_name).create() - Index(new_index_name).put_mapping(doc_type=doc, body=body) - reindex(connections.get_connection(), aggregate_index_name, new_index_name) # pyright: ignore[reportArgumentType] - Index(aggregate_index_name).delete() + (accepted for API compatibility; unused) + """ @@ -574,7 +633,10 @@ search = Search(index=search_index) query = org_name_query & report_id_query & domain_query query = query & begin_date_query & end_date_query - search.query = query + # elasticsearch.dsl's own docs recommend ``search.query = Q(...)``, but + # the ProxyDescriptor.__set__ stub is typed to accept only + # Dict[str, Any], not the Query object the docs tell you to assign. + search.query = query # pyright: ignore[reportAttributeAccessIssue] begin_date_human = begin_date.strftime("%Y-%m-%d %H:%M:%SZ") end_date_human = end_date.strftime("%Y-%m-%d %H:%M:%SZ") @@ -803,7 +865,7 @@ subject_query = {"match_phrase": {"sample.headers.subject": subject}} q = q & Q(subject_query) # pyright: ignore[reportArgumentType] - search.query = q + search.query = q # pyright: ignore[reportAttributeAccessIssue] existing = search.execute() if len(existing) > 0: @@ -947,7 +1009,7 @@ search = Search(index=search_index) query = org_name_query & report_id_query query = query & begin_date_query & end_date_query - search.query = query + search.query = query # pyright: ignore[reportAttributeAccessIssue] try: existing = search.execute() @@ -1037,7 +1099,7 @@ additional_information_uri=additional_information_uri, failure_reason_code=failure_reason_code, ) - smtp_tls_doc.policies.append(policy_doc) # pyright: ignore[reportCallIssue] + smtp_tls_doc.policies.append(policy_doc) create_indexes([index], index_settings) smtp_tls_doc.meta.index = index # pyright: ignore[reportOptionalMemberAccess, reportAttributeAccessIssue] diff --git a/_modules/parsedmarc/opensearch.html b/_modules/parsedmarc/opensearch.html index 460793dd..9910ee2c 100644 --- a/_modules/parsedmarc/opensearch.html +++ b/_modules/parsedmarc/opensearch.html @@ -5,14 +5,14 @@ - parsedmarc.opensearch — parsedmarc 10.2.2 documentation + parsedmarc.opensearch — parsedmarc 10.2.4 documentation - + diff --git a/_modules/parsedmarc/splunk.html b/_modules/parsedmarc/splunk.html index 0b8e523b..52bd3c40 100644 --- a/_modules/parsedmarc/splunk.html +++ b/_modules/parsedmarc/splunk.html @@ -5,14 +5,14 @@ - parsedmarc.splunk — parsedmarc 10.2.2 documentation + parsedmarc.splunk — parsedmarc 10.2.4 documentation - + @@ -89,15 +89,12 @@ from typing import Any from urllib.parse import urlparse -import requests -import urllib3 +import httpx from parsedmarc.constants import USER_AGENT from parsedmarc.log import logger from parsedmarc.utils import human_timestamp_to_unix_timestamp -urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) -
[docs] @@ -143,18 +140,19 @@ self.index = index self.host = socket.getfqdn() self.source = source - self.session = requests.Session() self.timeout = timeout self.verify = verify self._common_data: dict[str, str | int | float | dict] = dict( host=self.host, source=self.source, index=self.index ) - self.session.headers.update( - { + self.session = httpx.Client( + headers={ "User-Agent": USER_AGENT, "Authorization": "Splunk {0}".format(self.access_token), - } + }, + verify=self.verify, + follow_redirects=True, )
@@ -224,7 +222,7 @@ logger.debug("Skipping certificate verification for Splunk HEC") try: response = self.session.post( - self.url, data=json_str, verify=self.verify, timeout=self.timeout + self.url, content=json_str, timeout=self.timeout ) response = response.json() except Exception as e: @@ -270,7 +268,7 @@ logger.debug("Skipping certificate verification for Splunk HEC") try: response = self.session.post( - self.url, data=json_str, verify=self.verify, timeout=self.timeout + self.url, content=json_str, timeout=self.timeout ) response = response.json() except Exception as e: @@ -312,7 +310,7 @@ logger.debug("Skipping certificate verification for Splunk HEC") try: response = self.session.post( - self.url, data=json_str, verify=self.verify, timeout=self.timeout + self.url, content=json_str, timeout=self.timeout ) response = response.json() except Exception as e: diff --git a/_modules/parsedmarc/types.html b/_modules/parsedmarc/types.html index 6781bbe6..faaf2094 100644 --- a/_modules/parsedmarc/types.html +++ b/_modules/parsedmarc/types.html @@ -5,14 +5,14 @@ - parsedmarc.types — parsedmarc 10.2.2 documentation + parsedmarc.types — parsedmarc 10.2.4 documentation - + diff --git a/_modules/parsedmarc/utils.html b/_modules/parsedmarc/utils.html index 272f507e..cd897c2e 100644 --- a/_modules/parsedmarc/utils.html +++ b/_modules/parsedmarc/utils.html @@ -5,14 +5,14 @@ - parsedmarc.utils — parsedmarc 10.2.2 documentation + parsedmarc.utils — parsedmarc 10.2.4 documentation - + @@ -110,9 +110,9 @@ import dns.exception import dns.resolver import dns.reversename +import httpx import maxminddb import publicsuffixlist -import requests from dateutil.parser import parse as parse_date import parsedmarc.resources.ipinfo @@ -187,10 +187,12 @@ try: logger.debug(f"Trying to fetch PSL overrides from {url}...") headers = {"User-Agent": USER_AGENT} - response = requests.get(url, headers=headers) + response = httpx.get( + url, headers=headers, timeout=60, follow_redirects=True + ) response.raise_for_status() _load_text(response.text) - except requests.exceptions.RequestException as e: + except httpx.HTTPError as e: logger.warning(f"Failed to fetch PSL overrides: {e}") if len(psl_overrides) == 0: @@ -570,7 +572,9 @@ try: logger.debug(f"Trying to fetch IP database from {url}...") headers = {"User-Agent": USER_AGENT} - response = requests.get(url, headers=headers, timeout=60) + response = httpx.get( + url, headers=headers, timeout=60, follow_redirects=True + ) response.raise_for_status() os.makedirs(cache_dir, exist_ok=True) tmp_path = cached_path + ".tmp" @@ -580,7 +584,7 @@ _IP_DB_PATH = cached_path logger.info("IP database updated successfully") return - except requests.exceptions.RequestException as e: + except httpx.HTTPError as e: logger.warning(f"Failed to fetch IP database: {e}") except Exception as e: logger.warning(f"Failed to save IP database: {e}") @@ -676,10 +680,14 @@ params = {"token": _IPINFO_API_TOKEN} headers = {"User-Agent": USER_AGENT, "Accept": "application/json"} try: - response = requests.get( - url, headers=headers, params=params, timeout=_IPINFO_API_TIMEOUT + response = httpx.get( + url, + headers=headers, + params=params, + timeout=_IPINFO_API_TIMEOUT, + follow_redirects=True, ) - except requests.exceptions.RequestException as e: + except httpx.HTTPError as e: logger.debug(f"IPinfo API request for {ip_address} failed: {e}") return None @@ -687,7 +695,7 @@ raise InvalidIPinfoAPIKey( f"IPinfo API rejected the configured token (HTTP {response.status_code})" ) - if not response.ok: + if not response.is_success: logger.debug( f"IPinfo API returned HTTP {response.status_code} for {ip_address}" ) @@ -938,12 +946,14 @@ try: logger.debug(f"Trying to fetch reverse DNS map from {url}...") headers = {"User-Agent": USER_AGENT} - response = requests.get(url, headers=headers) + response = httpx.get( + url, headers=headers, timeout=60, follow_redirects=True + ) response.raise_for_status() csv_file.write(response.text) csv_file.seek(0) load_csv(csv_file) - except requests.exceptions.RequestException as e: + except httpx.HTTPError as e: logger.warning(f"Failed to fetch reverse DNS map: {e}") except Exception: logger.warning("Not a valid CSV file") diff --git a/_sources/elasticsearch.md.txt b/_sources/elasticsearch.md.txt index c4375279..ffdb972e 100644 --- a/_sources/elasticsearch.md.txt +++ b/_sources/elasticsearch.md.txt @@ -3,7 +3,10 @@ To set up visual dashboards of DMARC data, install Elasticsearch and Kibana. :::{note} -Elasticsearch and Kibana 6 or later are required +Elasticsearch and Kibana 8 or later are required (parsedmarc's 8.x Python +client also supports Elasticsearch 9). OpenSearch users must use the +`[opensearch]` configuration section instead — the Elasticsearch 8.x client +refuses to connect to non-Elasticsearch clusters. ::: ## Installation diff --git a/_sources/usage.md.txt b/_sources/usage.md.txt index 7a59150b..2d97dd29 100644 --- a/_sources/usage.md.txt +++ b/_sources/usage.md.txt @@ -249,12 +249,44 @@ The full set of configuration options are: could be a shared mailbox if the user has access to the mailbox - `graph_url` - str: Microsoft Graph URL. Allows for use of National Clouds (ex Azure Gov) (Default: https://graph.microsoft.com) + + :::{warning} + Setting `graph_url` alone is **not** sufficient for a national/sovereign + cloud tenant. It only changes the Microsoft Graph API root; the + Microsoft Entra ID (Azure AD) token endpoint used for authentication is + not currently configurable in parsedmarc or `mailsuite`, and always + defaults to the global `https://login.microsoftonline.com`. A true + national-cloud deployment also needs its own Entra ID endpoint, so + `graph_url` by itself only helps if your tenant is registered in the + global cloud but you specifically need to reach one of these Graph API + roots (per [Microsoft's national cloud deployment docs][ms-graph-clouds]): + + | National cloud | Microsoft Graph URL | Entra ID endpoint (not configurable here) | + |---|---|---| + | Global (default) | `https://graph.microsoft.com` | `https://login.microsoftonline.com` | + | US Government L4 (GCC High) | `https://graph.microsoft.us` | `https://login.microsoftonline.us` | + | US Government L5 (DoD) | `https://dod-graph.microsoft.us` | `https://login.microsoftonline.us` | + | China, operated by 21Vianet | `https://microsoftgraph.chinacloudapi.cn` | `https://login.chinacloudapi.cn` | + + [ms-graph-clouds]: https://learn.microsoft.com/en-us/graph/deployments + ::: - `token_file` - str: Path to save the token file (Default: `.token`) - `allow_unencrypted_storage` - bool: Allows the Azure Identity module to fall back to unencrypted token cache (Default: `False`). Even if enabled, the cache will always try encrypted storage first. + :::{note} + `token_file` stores the serialized authentication record; the + underlying MSAL persistent token cache is separately named + `parsedmarc`, not `mailsuite`'s own default cache name. This is + deliberate: the Graph mailbox backend used to live directly in + parsedmarc, and moved into the `mailsuite` dependency in parsedmarc + 9.11.0. Explicitly keeping the `parsedmarc` cache name means tokens + cached before that move keep working after upgrading — there is + nothing to migrate and no action needed on your part. + ::: + :::{note} You must create an app registration in Azure AD and have an admin grant the Microsoft Graph `Mail.ReadWrite` @@ -263,6 +295,11 @@ The full set of configuration options are: username, you must grant the app `Mail.ReadWrite.Shared`. ::: + | Auth method | Reading (own mailbox) | Reading (shared mailbox) | + |---|---|---| + | `UsernamePassword` / `DeviceCode` (delegated) | `Mail.ReadWrite` | `Mail.ReadWrite.Shared` | + | `ClientSecret` / `Certificate` / `ClientAssertion` (application) | `Mail.ReadWrite` (application), scoped via `New-ApplicationAccessPolicy` | same as own mailbox — app-only access is scoped by policy, not by permission name | + :::{tip} **Troubleshooting connections.** Run with `--verbose` to log a redacted connection summary (auth method, tenant, client ID, @@ -273,6 +310,11 @@ The full set of configuration options are: an Exchange Online-side one), Microsoft Graph SDK requests, and `httpx` HTTP request lines. Secret values (passwords, client secrets, certificate passwords) are never written to logs. + Connection, mailbox fetch, message send, and `--watch` failures + each log a single ERROR line naming the mailbox, tenant, auth + method, and the Graph `request-id`/`client-request-id` when + available — worth quoting verbatim when contacting Microsoft + support. ::: :::{warning} @@ -295,6 +337,120 @@ The full set of configuration options are: applies to the `Certificate` and `ClientAssertion` auth methods. ::: + + **Sending the summary email via Microsoft Graph.** + When `[msgraph]` is configured and `[smtp]` has a `to` value but no + `host`, the periodic summary email is sent through the same + already-authenticated Graph mailbox connection used for reading + (`/users/{mailbox}/sendMail`), and a copy is saved to Sent Items. + When `[smtp] host` is set, SMTP is used regardless of whether + `[msgraph]` is also configured — SMTP is always preferred, with no + automatic fallback to Graph on SMTP failure. + + Example config combining `[msgraph]` with a `[smtp]` section that + only sets `to`/`subject` (no `host`): + + ```ini + [msgraph] + auth_method = Certificate + client_id = ... + tenant_id = ... + mailbox = dmarc-reports@example.com + certificate_path = /path/to/cert.pem + + [smtp] + to = admin@example.com + subject = DMARC Summary + ``` + + Required Microsoft Graph permissions, in addition to the + reading-related permissions documented above: + + | Auth method | Reading | Sending (own mailbox) | Sending (shared mailbox) | + |---|---|---|---| + | `UsernamePassword` / `DeviceCode` (delegated) | `Mail.ReadWrite` (+`.Shared` for shared) | `Mail.Send` | `Mail.Send.Shared` | + | `ClientSecret` / `Certificate` / `ClientAssertion` (application) | `Mail.ReadWrite` (application) | `Mail.Send` (application) | `Mail.Send` (application), scoped via `New-ApplicationAccessPolicy` | + + :::{warning} + Graph-based sending is only confirmed to work with the app-only + auth methods (`ClientSecret`, `Certificate`, `ClientAssertion`). + The delegated auth methods (`UsernamePassword`, `DeviceCode`) + currently request only the `Mail.ReadWrite`(`.Shared`) scope when + authenticating, not `Mail.Send` — so a delegated connection's + access token will not carry `Mail.Send` even if an administrator + has granted it, and `/sendMail` calls are expected to fail with an + access-denied error regardless of what's granted in Azure AD. Use + an app-only auth method if you need Graph-based sending. + ::: + + **Minimal example configs.** Each auth method needs a different + minimum set of keys. These read-only examples omit `[smtp]`; see + above for adding Graph-based sending on top of any of them. + + `UsernamePassword` (delegated, own mailbox): + ```ini + [msgraph] + auth_method = UsernamePassword + client_id = ... + client_secret = ... + user = dmarc-reports@example.com + password = ... + ``` + + `DeviceCode` (delegated, interactive sign-in on first run — `user` + is the account that signs in; `mailbox` is the shared mailbox it + reads, and only needs to differ from `user` to request + `Mail.ReadWrite.Shared` instead of plain `Mail.ReadWrite`): + ```ini + [msgraph] + auth_method = DeviceCode + client_id = ... + tenant_id = ... + user = signing-in-user@example.com + mailbox = dmarc-reports@example.com + ``` + + `ClientSecret` (app-only): + ```ini + [msgraph] + auth_method = ClientSecret + client_id = ... + tenant_id = ... + client_secret = ... + mailbox = dmarc-reports@example.com + ``` + + `Certificate` (app-only): + ```ini + [msgraph] + auth_method = Certificate + client_id = ... + tenant_id = ... + certificate_path = /path/to/cert.pem + mailbox = dmarc-reports@example.com + ``` + + `ClientAssertion` (app-only, short-lived JWT — see the note above + about its unsuitability for `watch` mode): + ```ini + [msgraph] + auth_method = ClientAssertion + client_id = ... + tenant_id = ... + client_assertion = ... + mailbox = dmarc-reports@example.com + ``` + + :::{tip} + **Troubleshooting.** + + | Error | Cause | Fix | + |---|---|---| + | *"...needs permission to access resources in your organization that only an admin can grant"* / "Admin consent required" | A delegated auth method (`UsernamePassword`, `DeviceCode`) is authenticating with a scope (`Mail.ReadWrite` or `Mail.ReadWrite.Shared`) the tenant admin hasn't consented to yet. | Have an Entra ID admin grant consent: Azure Portal → **Enterprise Applications** → *your app* → **Permissions** → **Grant admin consent**, or `az ad app permission admin-consent --id `. This is separate from the `New-ApplicationAccessPolicy` step above, which only applies to app-only auth. | + | `ErrorItemNotFound: ... Default folder Root not found` | `mailsuite` can resolve the well-known folders (`Inbox`, `Archive`, `Drafts`, `Sent Items`, `Deleted Items`, `Junk Email`) even when a mailbox's folder hierarchy hasn't fully provisioned, but a **custom, non-well-known** `reports_folder` name still fails to resolve on such a mailbox. | Point `reports_folder` at (or under) one of the six well-known folder names above, or sign into the (shared) mailbox once via Outlook/OWA to force Exchange to provision it, then retry. | + | `RuntimeError: Event loop is closed` | Historical bug, fixed in `mailsuite` 2.0.2. Not reachable with the `mailsuite>=2.2.2` this project requires. | Confirm your installed `mailsuite` version is current (`pip show mailsuite`); upgrade if it's somehow pinned below 2.0.2. | + | Invalid/rejected timestamp in the `since`/`receivedDateTime` filter | Historical bug (parsedmarc [#706](https://github.com/domainaware/parsedmarc/pull/706)/[#708](https://github.com/domainaware/parsedmarc/pull/708)): older versions appended a spurious `Z` to an already-UTC-offset ISO timestamp. Fixed since parsedmarc 9.5.1/9.5.5. | Upgrade parsedmarc if you're on a version older than 9.5.5. | + ::: - `elasticsearch` - `hosts` - str: A comma separated list of hostnames and ports or URLs (e.g. `127.0.0.1:9200` or @@ -371,20 +527,28 @@ The full set of configuration options are: - `aggregate_topic` - str: The Kafka topic for aggregate reports - `failure_topic` - str: The Kafka topic for failure reports - `smtp` - - `host` - str: The SMTP hostname + - `host` - str: The SMTP hostname. Required unless `[msgraph]` is + configured, in which case omitting it sends the summary via + Microsoft Graph instead — see "Sending the summary email via + Microsoft Graph" above. - `port` - int: The SMTP port (Default: `25`) - `ssl` - bool: Require SSL/TLS instead of using STARTTLS - `skip_certificate_verification` - bool: Skip certificate verification (not recommended) - - `user` - str: the SMTP username - - `password` - str: the SMTP password - - `from` - str: The From header to use in the email + - `user` - str: the SMTP username. SMTP-only; not used when sending + via Microsoft Graph. + - `password` - str: the SMTP password. SMTP-only; not used when + sending via Microsoft Graph. + - `from` - str: The From header to use in the email. SMTP-only. + When sent via Microsoft Graph, the message's `From` is always the + `[msgraph]` mailbox — `[smtp] from` has no effect. - `to` - list: A list of email addresses to send to - `subject` - str: The Subject header to use in the email (Default: `parsedmarc report`) - `attachment` - str: The ZIP attachment filenames + (Default: `DMARC-.zip`) - `message` - str: The email message - (Default: `Please see the attached parsedmarc report.`) + (Default: `Please see the attached DMARC results.`) :::{note} `%` characters must be escaped with another `%` character, diff --git a/_static/documentation_options.js b/_static/documentation_options.js index 876cc396..eb3f216d 100644 --- a/_static/documentation_options.js +++ b/_static/documentation_options.js @@ -1,5 +1,5 @@ const DOCUMENTATION_OPTIONS = { - VERSION: '10.2.2', + VERSION: '10.2.4', LANGUAGE: 'en', COLLAPSE_INDEX: false, BUILDER: 'html', diff --git a/api.html b/api.html index d528fb6b..895b47a9 100644 --- a/api.html +++ b/api.html @@ -6,14 +6,14 @@ - API reference — parsedmarc 10.2.2 documentation + API reference — parsedmarc 10.2.4 documentation - + @@ -63,6 +63,7 @@
  • ParserError
  • append_json()
  • email_results()
    • +
  • email_results_via_msgraph()
  • extract_report()
  • extract_report_from_file_path()
  • get_dmarc_reports_from_mailbox()
    • @@ -294,6 +295,29 @@ JSON array out of repeated appends.

    +
    +
    +parsedmarc.email_results_via_msgraph(results: ParsingResults, connection: MSGraphConnection, mail_to: list[str], *, mail_cc: list[str] | None = None, mail_bcc: list[str] | None = None, subject: str | None = None, attachment_filename: str | None = None, message: str | None = None) → None[source]
    +

    Emails parsing results as a zip file via an already-authenticated +Microsoft Graph mailbox connection (/users/{mailbox}/sendMail), +saving a copy to Sent Items.

    +
    +
    Parameters:
    +
      +

    • results (dict) – Parsing results

      • +

    • connection (MSGraphConnection) – An already-authenticated Microsoft +Graph mailbox connection

      • +

    • mail_to (list) – A list of addresses to mail to

      • +

    • mail_cc (list) – A list of addresses to CC

      • +

    • mail_bcc (list) – A list addresses to BCC

      • +

    • subject (str) – Overrides the default message subject

      • +

    • attachment_filename (str) – Override the default attachment filename

      • +

    • message (str) – Override the default plain text body

      • +
    +
    +
    +
    +
    parsedmarc.extract_report(content: bytes | str | BinaryIO) → str[source]
    @@ -850,13 +874,21 @@ remaining keys are passed through; defaults are skipped entirely.

    parsedmarc.elastic.migrate_indexes(aggregate_indexes: list[str] | None = None, failure_indexes: list[str] | None = None)[source]

    Updates index mappings

    +

    This is a no-op kept for API compatibility (cli.py calls it on +startup). The only migration this function ever performed was +re-typing published_policy.fo from long to text, which +applied exclusively to indices still carrying the legacy +Elasticsearch 6-era "doc" mapping type. The 8.x client can only +reach servers (Elasticsearch 8.x/9.x) whose indices were created on +Elasticsearch 7.x or later and are therefore typeless, so that +migration path is unreachable and has been removed.

    Parameters:
      -

    • aggregate_indexes (list) – A list of aggregate index names

      • +

    • aggregate_indexes (list) – A list of aggregate index names +(accepted for API compatibility; unused)

    • failure_indexes (list) – A list of failure index names -(accepted for API compatibility; no migrations are -currently needed for failure indexes)

      • +(accepted for API compatibility; unused)

    @@ -958,7 +990,9 @@ index

    Parameters:

    • hosts (str | list[str]) – A single hostname or URL, or list of hostnames or URLs

      • -

    • use_ssl (bool) – Use an HTTPS connection to the server

      • +

    • use_ssl (bool) – Controls the scheme prepended to any host that doesn’t +already include one (https:// when True, http:// when +False). Hosts that already carry a scheme are left unchanged.

    • ssl_cert_path (str) – Path to the certificate chain

    • skip_certificate_verification (bool) – Skip certificate verification

    • username (str) – The username to use for authentication

      • diff --git a/contributing.html b/contributing.html index 474ca027..d4416a33 100644 --- a/contributing.html +++ b/contributing.html @@ -6,14 +6,14 @@ - Contributing to parsedmarc — parsedmarc 10.2.2 documentation + Contributing to parsedmarc — parsedmarc 10.2.4 documentation - + diff --git a/davmail.html b/davmail.html index 23f0ee92..2167436f 100644 --- a/davmail.html +++ b/davmail.html @@ -6,14 +6,14 @@ - Accessing an inbox using OWA/EWS — parsedmarc 10.2.2 documentation + Accessing an inbox using OWA/EWS — parsedmarc 10.2.4 documentation - + diff --git a/dmarc.html b/dmarc.html index 83b09d37..1d5964b1 100644 --- a/dmarc.html +++ b/dmarc.html @@ -6,14 +6,14 @@ - Understanding DMARC — parsedmarc 10.2.2 documentation + Understanding DMARC — parsedmarc 10.2.4 documentation - + diff --git a/elasticsearch.html b/elasticsearch.html index 9d610944..961ead1a 100644 --- a/elasticsearch.html +++ b/elasticsearch.html @@ -6,14 +6,14 @@ - Elasticsearch and Kibana — parsedmarc 10.2.2 documentation + Elasticsearch and Kibana — parsedmarc 10.2.4 documentation - + @@ -91,7 +91,10 @@

      To set up visual dashboards of DMARC data, install Elasticsearch and Kibana.

      Note

      -

      Elasticsearch and Kibana 6 or later are required

      +

      Elasticsearch and Kibana 8 or later are required (parsedmarc’s 8.x Python +client also supports Elasticsearch 9). OpenSearch users must use the +[opensearch] configuration section instead — the Elasticsearch 8.x client +refuses to connect to non-Elasticsearch clusters.

      Installation

      diff --git a/genindex.html b/genindex.html index 15d13f7d..04d38a80 100644 --- a/genindex.html +++ b/genindex.html @@ -5,14 +5,14 @@ - Index — parsedmarc 10.2.2 documentation + Index — parsedmarc 10.2.4 documentation - + @@ -174,6 +174,8 @@
    • ElasticsearchError
    • email_results() (in module parsedmarc) +
      • +
    • email_results_via_msgraph() (in module parsedmarc)
    • EmailAddress (class in parsedmarc.types)
      • diff --git a/index.html b/index.html index bff2d6b8..78efa26a 100644 --- a/index.html +++ b/index.html @@ -6,14 +6,14 @@ - parsedmarc documentation - Open source DMARC report analyzer and visualizer — parsedmarc 10.2.2 documentation + parsedmarc documentation - Open source DMARC report analyzer and visualizer — parsedmarc 10.2.4 documentation - + diff --git a/installation.html b/installation.html index c7a81ce3..221ce3f6 100644 --- a/installation.html +++ b/installation.html @@ -6,14 +6,14 @@ - Installation — parsedmarc 10.2.2 documentation + Installation — parsedmarc 10.2.4 documentation - + diff --git a/kibana.html b/kibana.html index 8fd3d653..a45e6182 100644 --- a/kibana.html +++ b/kibana.html @@ -6,14 +6,14 @@ - Using the Kibana dashboards — parsedmarc 10.2.2 documentation + Using the Kibana dashboards — parsedmarc 10.2.4 documentation - + diff --git a/mailing-lists.html b/mailing-lists.html index f2ef9171..9eb48a7c 100644 --- a/mailing-lists.html +++ b/mailing-lists.html @@ -6,14 +6,14 @@ - What about mailing lists? — parsedmarc 10.2.2 documentation + What about mailing lists? — parsedmarc 10.2.4 documentation - + diff --git a/objects.inv b/objects.inv index d2c52c84..2779d19f 100644 Binary files a/objects.inv and b/objects.inv differ diff --git a/opensearch.html b/opensearch.html index 3a11b75b..d95b4663 100644 --- a/opensearch.html +++ b/opensearch.html @@ -6,14 +6,14 @@ - OpenSearch and Grafana — parsedmarc 10.2.2 documentation + OpenSearch and Grafana — parsedmarc 10.2.4 documentation - + diff --git a/output.html b/output.html index c83edece..934354f3 100644 --- a/output.html +++ b/output.html @@ -6,14 +6,14 @@ - Sample outputs — parsedmarc 10.2.2 documentation + Sample outputs — parsedmarc 10.2.4 documentation - + diff --git a/py-modindex.html b/py-modindex.html index 2e2ddd2c..bb30c353 100644 --- a/py-modindex.html +++ b/py-modindex.html @@ -5,14 +5,14 @@ - Python Module Index — parsedmarc 10.2.2 documentation + Python Module Index — parsedmarc 10.2.4 documentation - + diff --git a/search.html b/search.html index f1cf3ff2..3b0906bc 100644 --- a/search.html +++ b/search.html @@ -5,7 +5,7 @@ - Search — parsedmarc 10.2.2 documentation + Search — parsedmarc 10.2.4 documentation @@ -13,7 +13,7 @@ - + diff --git a/searchindex.js b/searchindex.js index 07601395..fda91804 100644 --- a/searchindex.js +++ b/searchindex.js @@ -1 +1 @@ -Search.setIndex({"alltitles":{"API reference":[[0,null]],"Accessing an inbox using OWA/EWS":[[2,null]],"Bug reports":[[1,"bug-reports"]],"CLI help":[[12,"cli-help"]],"CSV aggregate report":[[10,"csv-aggregate-report"]],"CSV failure report":[[10,"csv-failure-report"]],"Configuration file":[[12,"configuration-file"]],"Configuring parsedmarc for DavMail":[[2,"configuring-parsedmarc-for-davmail"]],"Contents":[[5,null]],"Contributing to parsedmarc":[[1,null]],"DMARC Alignment Guide":[[3,"dmarc-alignment-guide"]],"DMARC aggregate reports":[[7,"dmarc-aggregate-reports"]],"DMARC failure reports":[[7,"dmarc-failure-reports"]],"DMARC guides":[[3,"dmarc-guides"]],"Do":[[3,"do"],[8,"do"]],"Do not":[[3,"do-not"],[8,"do-not"]],"Docker Compose example":[[12,"docker-compose-example"]],"Docker secrets (_FILE suffix)":[[12,"docker-secrets-file-suffix"]],"Elasticsearch and Kibana":[[4,null]],"Environment variable configuration":[[12,"environment-variable-configuration"]],"Examples":[[12,"examples"]],"Features":[[5,"features"]],"IP-to-country database":[[6,"ip-to-country-database"]],"Indices and tables":[[0,"indices-and-tables"]],"Installation":[[4,"installation"],[6,null],[9,"installation"]],"Installing parsedmarc":[[6,"installing-parsedmarc"]],"JSON SMTP TLS report":[[10,"json-smtp-tls-report"]],"JSON aggregate report":[[10,"json-aggregate-report"]],"JSON failure report":[[10,"json-failure-report"]],"LISTSERV":[[3,"listserv"],[8,"listserv"]],"Lookalike domains":[[3,"lookalike-domains"]],"Mailing list best practices":[[3,"mailing-list-best-practices"],[8,"mailing-list-best-practices"]],"Mailman 2":[[3,"mailman-2"],[3,"id1"],[8,"mailman-2"],[8,"id1"]],"Mailman 3":[[3,"mailman-3"],[3,"id2"],[8,"mailman-3"],[8,"id2"]],"Multi-tenant support":[[12,"multi-tenant-support"]],"OpenSearch and Grafana":[[9,null]],"Optional dependencies":[[6,"optional-dependencies"]],"Performance tuning":[[12,"performance-tuning"]],"Prerequisites":[[6,"prerequisites"]],"Python Compatibility":[[5,"python-compatibility"]],"Records retention":[[4,"records-retention"],[9,"records-retention"]],"Reloading configuration without restarting":[[12,"reloading-configuration-without-restarting"]],"Resources":[[3,"resources"]],"Running DavMail as a systemd service":[[2,"running-davmail-as-a-systemd-service"]],"Running parsedmarc as a systemd service":[[12,"running-parsedmarc-as-a-systemd-service"]],"Running without a config file (env-only mode)":[[12,"running-without-a-config-file-env-only-mode"]],"SMTP TLS reporting":[[7,"smtp-tls-reporting"]],"SPF and DMARC record validation":[[3,"spf-and-dmarc-record-validation"]],"Sample aggregate report output":[[10,"sample-aggregate-report-output"]],"Sample failure report output":[[10,"sample-failure-report-output"]],"Sample outputs":[[10,null]],"Section name mapping":[[12,"section-name-mapping"]],"Specifying the config file via environment variable":[[12,"specifying-the-config-file-via-environment-variable"]],"Splunk":[[11,null]],"Testing multiple report analyzers":[[6,"testing-multiple-report-analyzers"]],"Understanding DMARC":[[3,null]],"Upgrading Kibana index patterns":[[4,"upgrading-kibana-index-patterns"]],"Using MaxMind GeoLite2 (optional)":[[6,"using-maxmind-geolite2-optional"]],"Using Microsoft Exchange":[[6,"using-microsoft-exchange"]],"Using a web proxy":[[6,"using-a-web-proxy"]],"Using parsedmarc":[[12,null]],"Using the Kibana dashboards":[[7,null]],"What about mailing lists?":[[3,"what-about-mailing-lists"],[8,null]],"What if a sender won\u2019t support DKIM/DMARC?":[[3,"what-if-a-sender-wont-support-dkim-dmarc"]],"Workarounds":[[3,"workarounds"],[8,"workarounds"]],"parsedmarc":[[0,"module-parsedmarc"]],"parsedmarc documentation - Open source DMARC report analyzer and visualizer":[[5,null]],"parsedmarc.elastic":[[0,"module-parsedmarc.elastic"]],"parsedmarc.opensearch":[[0,"module-parsedmarc.opensearch"]],"parsedmarc.splunk":[[0,"module-parsedmarc.splunk"]],"parsedmarc.types":[[0,"module-parsedmarc.types"]],"parsedmarc.utils":[[0,"module-parsedmarc.utils"]]},"docnames":["api","contributing","davmail","dmarc","elasticsearch","index","installation","kibana","mailing-lists","opensearch","output","splunk","usage"],"envversion":{"sphinx":66,"sphinx.domains.c":3,"sphinx.domains.changeset":1,"sphinx.domains.citation":1,"sphinx.domains.cpp":9,"sphinx.domains.index":1,"sphinx.domains.javascript":3,"sphinx.domains.math":2,"sphinx.domains.python":4,"sphinx.domains.rst":2,"sphinx.domains.std":2,"sphinx.ext.todo":2,"sphinx.ext.viewcode":1},"filenames":["api.md","contributing.md","davmail.md","dmarc.md","elasticsearch.md","index.md","installation.md","kibana.md","mailing-lists.md","opensearch.md","output.md","splunk.md","usage.md"],"indexentries":{"aggregatealignment (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAlignment",false]],"aggregateauthresultdkim (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResultDKIM",false]],"aggregateauthresults (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResults",false]],"aggregateauthresultspf (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResultSPF",false]],"aggregateidentifiers (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateIdentifiers",false]],"aggregateparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateParsedReport",false]],"aggregatepolicyevaluated (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyEvaluated",false]],"aggregatepolicyoverridereason (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyOverrideReason",false]],"aggregatepolicypublished (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyPublished",false]],"aggregaterecord (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateRecord",false]],"aggregatereport (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateReport",false]],"aggregatereportmetadata (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateReportMetadata",false]],"alreadysaved":[[0,"parsedmarc.elastic.AlreadySaved",false],[0,"parsedmarc.opensearch.AlreadySaved",false]],"append_json() (in module parsedmarc)":[[0,"parsedmarc.append_json",false]],"close() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.close",false]],"configure_ipinfo_api() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.configure_ipinfo_api",false]],"convert_outlook_msg() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.convert_outlook_msg",false]],"create_indexes() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.create_indexes",false]],"create_indexes() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.create_indexes",false]],"decode_base64() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.decode_base64",false]],"downloaderror":[[0,"parsedmarc.utils.DownloadError",false]],"elasticsearcherror":[[0,"parsedmarc.elastic.ElasticsearchError",false]],"email_results() (in module parsedmarc)":[[0,"parsedmarc.email_results",false]],"emailaddress (class in parsedmarc.types)":[[0,"parsedmarc.types.EmailAddress",false]],"emailattachment (class in parsedmarc.types)":[[0,"parsedmarc.types.EmailAttachment",false]],"emailparsererror":[[0,"parsedmarc.utils.EmailParserError",false]],"extract_report() (in module parsedmarc)":[[0,"parsedmarc.extract_report",false]],"extract_report_from_file_path() (in module parsedmarc)":[[0,"parsedmarc.extract_report_from_file_path",false]],"failureparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.FailureParsedReport",false]],"failurereport (class in parsedmarc.types)":[[0,"parsedmarc.types.FailureReport",false]],"forensicparsedreport (in module parsedmarc.types)":[[0,"parsedmarc.types.ForensicParsedReport",false]],"forensicreport (in module parsedmarc.types)":[[0,"parsedmarc.types.ForensicReport",false]],"get_base_domain() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_base_domain",false]],"get_dmarc_reports_from_mailbox() (in module parsedmarc)":[[0,"parsedmarc.get_dmarc_reports_from_mailbox",false]],"get_dmarc_reports_from_mbox() (in module parsedmarc)":[[0,"parsedmarc.get_dmarc_reports_from_mbox",false]],"get_filename_safe_string() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_filename_safe_string",false]],"get_ip_address_country() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_country",false]],"get_ip_address_db_record() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_db_record",false]],"get_ip_address_info() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_info",false]],"get_report_zip() (in module parsedmarc)":[[0,"parsedmarc.get_report_zip",false]],"get_reverse_dns() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_reverse_dns",false]],"get_service_from_reverse_dns_base_domain() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_service_from_reverse_dns_base_domain",false]],"hecclient (class in parsedmarc.splunk)":[[0,"parsedmarc.splunk.HECClient",false]],"human_timestamp_to_datetime() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.human_timestamp_to_datetime",false]],"human_timestamp_to_unix_timestamp() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.human_timestamp_to_unix_timestamp",false]],"invalidaggregatereport":[[0,"parsedmarc.InvalidAggregateReport",false]],"invaliddmarcreport":[[0,"parsedmarc.InvalidDMARCReport",false]],"invalidfailurereport":[[0,"parsedmarc.InvalidFailureReport",false]],"invalidforensicreport (in module parsedmarc)":[[0,"parsedmarc.InvalidForensicReport",false]],"invalidipinfoapikey":[[0,"parsedmarc.utils.InvalidIPinfoAPIKey",false]],"invalidsmtptlsreport":[[0,"parsedmarc.InvalidSMTPTLSReport",false]],"ipaddressinfo (class in parsedmarc.utils)":[[0,"parsedmarc.utils.IPAddressInfo",false]],"ipsourceinfo (class in parsedmarc.types)":[[0,"parsedmarc.types.IPSourceInfo",false]],"is_mbox() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.is_mbox",false]],"is_outlook_msg() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.is_outlook_msg",false]],"load_ip_db() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_ip_db",false]],"load_psl_overrides() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_psl_overrides",false]],"load_reverse_dns_map() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_reverse_dns_map",false]],"migrate_indexes() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.migrate_indexes",false]],"migrate_indexes() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.migrate_indexes",false]],"module":[[0,"module-parsedmarc",false],[0,"module-parsedmarc.elastic",false],[0,"module-parsedmarc.opensearch",false],[0,"module-parsedmarc.splunk",false],[0,"module-parsedmarc.types",false],[0,"module-parsedmarc.utils",false]],"opensearcherror":[[0,"parsedmarc.opensearch.OpenSearchError",false]],"parse_aggregate_report_file() (in module parsedmarc)":[[0,"parsedmarc.parse_aggregate_report_file",false]],"parse_aggregate_report_xml() (in module parsedmarc)":[[0,"parsedmarc.parse_aggregate_report_xml",false]],"parse_email() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.parse_email",false]],"parse_failure_report() (in module parsedmarc)":[[0,"parsedmarc.parse_failure_report",false]],"parse_forensic_report() (in module parsedmarc)":[[0,"parsedmarc.parse_forensic_report",false]],"parse_report_email() (in module parsedmarc)":[[0,"parsedmarc.parse_report_email",false]],"parse_report_file() (in module parsedmarc)":[[0,"parsedmarc.parse_report_file",false]],"parse_smtp_tls_report_json() (in module parsedmarc)":[[0,"parsedmarc.parse_smtp_tls_report_json",false]],"parsed_aggregate_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_aggregate_reports_to_csv",false]],"parsed_aggregate_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_aggregate_reports_to_csv_rows",false]],"parsed_failure_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_failure_reports_to_csv",false]],"parsed_failure_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_failure_reports_to_csv_rows",false]],"parsed_forensic_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_forensic_reports_to_csv",false]],"parsed_forensic_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_forensic_reports_to_csv_rows",false]],"parsed_smtp_tls_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_smtp_tls_reports_to_csv",false]],"parsed_smtp_tls_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_smtp_tls_reports_to_csv_rows",false]],"parsedemail (class in parsedmarc.types)":[[0,"parsedmarc.types.ParsedEmail",false]],"parsedmarc":[[0,"module-parsedmarc",false]],"parsedmarc.elastic":[[0,"module-parsedmarc.elastic",false]],"parsedmarc.opensearch":[[0,"module-parsedmarc.opensearch",false]],"parsedmarc.splunk":[[0,"module-parsedmarc.splunk",false]],"parsedmarc.types":[[0,"module-parsedmarc.types",false]],"parsedmarc.utils":[[0,"module-parsedmarc.utils",false]],"parsererror":[[0,"parsedmarc.ParserError",false]],"parsingresults (class in parsedmarc.types)":[[0,"parsedmarc.types.ParsingResults",false]],"query_dns() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.query_dns",false]],"reversednsservice (class in parsedmarc.utils)":[[0,"parsedmarc.utils.ReverseDNSService",false]],"save_aggregate_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_aggregate_report_to_elasticsearch",false]],"save_aggregate_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_aggregate_report_to_opensearch",false]],"save_aggregate_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_aggregate_reports_to_splunk",false]],"save_failure_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_failure_report_to_elasticsearch",false]],"save_failure_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_failure_report_to_opensearch",false]],"save_failure_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_failure_reports_to_splunk",false]],"save_forensic_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_forensic_report_to_elasticsearch",false]],"save_forensic_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_forensic_report_to_opensearch",false]],"save_forensic_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_forensic_reports_to_splunk",false]],"save_output() (in module parsedmarc)":[[0,"parsedmarc.save_output",false]],"save_smtp_tls_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_smtp_tls_report_to_elasticsearch",false]],"save_smtp_tls_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_smtp_tls_report_to_opensearch",false]],"save_smtp_tls_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_smtp_tls_reports_to_splunk",false]],"set_hosts() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.set_hosts",false]],"set_hosts() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.set_hosts",false]],"smtptlsfailuredetails (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSFailureDetails",false]],"smtptlsfailuredetailsoptional (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSFailureDetailsOptional",false]],"smtptlsparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSParsedReport",false]],"smtptlspolicy (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSPolicy",false]],"smtptlspolicysummary (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSPolicySummary",false]],"smtptlsreport (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSReport",false]],"splunkerror":[[0,"parsedmarc.splunk.SplunkError",false]],"timestamp_to_datetime() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.timestamp_to_datetime",false]],"timestamp_to_human() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.timestamp_to_human",false]],"watch_inbox() (in module parsedmarc)":[[0,"parsedmarc.watch_inbox",false]]},"objects":{"":[[0,0,0,"-","parsedmarc"]],"parsedmarc":[[0,1,1,"","InvalidAggregateReport"],[0,1,1,"","InvalidDMARCReport"],[0,1,1,"","InvalidFailureReport"],[0,2,1,"","InvalidForensicReport"],[0,1,1,"","InvalidSMTPTLSReport"],[0,1,1,"","ParserError"],[0,3,1,"","append_json"],[0,0,0,"-","elastic"],[0,3,1,"","email_results"],[0,3,1,"","extract_report"],[0,3,1,"","extract_report_from_file_path"],[0,3,1,"","get_dmarc_reports_from_mailbox"],[0,3,1,"","get_dmarc_reports_from_mbox"],[0,3,1,"","get_report_zip"],[0,0,0,"-","opensearch"],[0,3,1,"","parse_aggregate_report_file"],[0,3,1,"","parse_aggregate_report_xml"],[0,3,1,"","parse_failure_report"],[0,3,1,"","parse_forensic_report"],[0,3,1,"","parse_report_email"],[0,3,1,"","parse_report_file"],[0,3,1,"","parse_smtp_tls_report_json"],[0,3,1,"","parsed_aggregate_reports_to_csv"],[0,3,1,"","parsed_aggregate_reports_to_csv_rows"],[0,3,1,"","parsed_failure_reports_to_csv"],[0,3,1,"","parsed_failure_reports_to_csv_rows"],[0,3,1,"","parsed_forensic_reports_to_csv"],[0,3,1,"","parsed_forensic_reports_to_csv_rows"],[0,3,1,"","parsed_smtp_tls_reports_to_csv"],[0,3,1,"","parsed_smtp_tls_reports_to_csv_rows"],[0,3,1,"","save_output"],[0,0,0,"-","splunk"],[0,0,0,"-","types"],[0,0,0,"-","utils"],[0,3,1,"","watch_inbox"]],"parsedmarc.elastic":[[0,1,1,"","AlreadySaved"],[0,1,1,"","ElasticsearchError"],[0,3,1,"","create_indexes"],[0,3,1,"","migrate_indexes"],[0,3,1,"","save_aggregate_report_to_elasticsearch"],[0,3,1,"","save_failure_report_to_elasticsearch"],[0,3,1,"","save_forensic_report_to_elasticsearch"],[0,3,1,"","save_smtp_tls_report_to_elasticsearch"],[0,3,1,"","set_hosts"]],"parsedmarc.opensearch":[[0,1,1,"","AlreadySaved"],[0,1,1,"","OpenSearchError"],[0,3,1,"","create_indexes"],[0,3,1,"","migrate_indexes"],[0,3,1,"","save_aggregate_report_to_opensearch"],[0,3,1,"","save_failure_report_to_opensearch"],[0,3,1,"","save_forensic_report_to_opensearch"],[0,3,1,"","save_smtp_tls_report_to_opensearch"],[0,3,1,"","set_hosts"]],"parsedmarc.splunk":[[0,4,1,"","HECClient"],[0,1,1,"","SplunkError"]],"parsedmarc.splunk.HECClient":[[0,5,1,"","close"],[0,5,1,"","save_aggregate_reports_to_splunk"],[0,5,1,"","save_failure_reports_to_splunk"],[0,5,1,"","save_forensic_reports_to_splunk"],[0,5,1,"","save_smtp_tls_reports_to_splunk"]],"parsedmarc.types":[[0,4,1,"","AggregateAlignment"],[0,4,1,"","AggregateAuthResultDKIM"],[0,4,1,"","AggregateAuthResultSPF"],[0,4,1,"","AggregateAuthResults"],[0,4,1,"","AggregateIdentifiers"],[0,4,1,"","AggregateParsedReport"],[0,4,1,"","AggregatePolicyEvaluated"],[0,4,1,"","AggregatePolicyOverrideReason"],[0,4,1,"","AggregatePolicyPublished"],[0,4,1,"","AggregateRecord"],[0,4,1,"","AggregateReport"],[0,4,1,"","AggregateReportMetadata"],[0,4,1,"","EmailAddress"],[0,4,1,"","EmailAttachment"],[0,4,1,"","FailureParsedReport"],[0,4,1,"","FailureReport"],[0,2,1,"","ForensicParsedReport"],[0,2,1,"","ForensicReport"],[0,4,1,"","IPSourceInfo"],[0,4,1,"","ParsedEmail"],[0,4,1,"","ParsingResults"],[0,4,1,"","SMTPTLSFailureDetails"],[0,4,1,"","SMTPTLSFailureDetailsOptional"],[0,4,1,"","SMTPTLSParsedReport"],[0,4,1,"","SMTPTLSPolicy"],[0,4,1,"","SMTPTLSPolicySummary"],[0,4,1,"","SMTPTLSReport"]],"parsedmarc.utils":[[0,1,1,"","DownloadError"],[0,1,1,"","EmailParserError"],[0,4,1,"","IPAddressInfo"],[0,1,1,"","InvalidIPinfoAPIKey"],[0,4,1,"","ReverseDNSService"],[0,3,1,"","configure_ipinfo_api"],[0,3,1,"","convert_outlook_msg"],[0,3,1,"","decode_base64"],[0,3,1,"","get_base_domain"],[0,3,1,"","get_filename_safe_string"],[0,3,1,"","get_ip_address_country"],[0,3,1,"","get_ip_address_db_record"],[0,3,1,"","get_ip_address_info"],[0,3,1,"","get_reverse_dns"],[0,3,1,"","get_service_from_reverse_dns_base_domain"],[0,3,1,"","human_timestamp_to_datetime"],[0,3,1,"","human_timestamp_to_unix_timestamp"],[0,3,1,"","is_mbox"],[0,3,1,"","is_outlook_msg"],[0,3,1,"","load_ip_db"],[0,3,1,"","load_psl_overrides"],[0,3,1,"","load_reverse_dns_map"],[0,3,1,"","parse_email"],[0,3,1,"","query_dns"],[0,3,1,"","timestamp_to_datetime"],[0,3,1,"","timestamp_to_human"]]},"objnames":{"0":["py","module","Python module"],"1":["py","exception","Python exception"],"2":["py","attribute","Python attribute"],"3":["py","function","Python function"],"4":["py","class","Python class"],"5":["py","method","Python method"]},"objtypes":{"0":"py:module","1":"py:exception","2":"py:attribute","3":"py:function","4":"py:class","5":"py:method"},"terms":{"00z":10,"00z_exampl":10,"09t00":10,"09t23":10,"1d":12,"1g":4,"1w":12,"2017a":[3,8],"2d":12,"2k":12,"30s":12,"3d":10,"3h":12,"59z":10,"5m":[2,12],"7d":12,"A":[0,3,7,12],"AT":10,"After":[2,12],"All":[3,8,12],"An":[0,12],"And":0,"As":[4,7],"By":[7,12],"Do":[0,12],"For":[4,12],"From":[3,7,8,12],"Further":7,"Here":10,"IF":12,"If":[0,3,4,6,7,8,12],"In":[0,2,3,7,8,12],"It":[2,4,7,10,12],"More":6,"Most":[7,12],"NOT":12,"No":[3,6,8],"On":[3,4,6,7,8,12],"Or":[4,6,12],"Some":[2,3,7,8],"That":7,"The":[0,3,6,7,11,12],"Then":[2,3,4,6,8,12],"There":7,"These":[7,12],"This":[5,6,7,10,12],"To":[2,4,6,7,9,10,12],"Under":[4,7],"What":5,"When":[0,3,5,8,12],"Where":[3,8],"While":[7,12],"With":[7,12],"YOUR":4,"You":[2,7,12],"_":12,"_attempt":0,"_cluster":12,"_input":0,"_ipdatabaserecord":0,"_serverless_rejected_set":0,"aadst":12,"abl":6,"abort":12,"abov":[2,6,12],"accept":[0,3,4,7,8,12],"access":[0,4,5,12],"access_key_id":12,"access_token":0,"accessright":12,"accident":[3,8],"account":[6,7,12],"acm":10,"acquir":12,"acquisit":12,"across":7,"action":[3,8],"activ":[4,5,12],"active_primary_shard":12,"active_shard":12,"actual":[3,10],"ad":12,"add":[2,3,4,6,7,8,12],"addit":[3,8,12],"address":[0,2,3,4,6,7,8,10,12],"addresse":7,"adkim":10,"admin":[3,8,12],"administr":[3,8],"agari":5,"agent":4,"aggreg":[0,5,11,12],"aggregate_csv_filenam":[0,12],"aggregate_index":0,"aggregate_json_filenam":[0,12],"aggregate_report":0,"aggregate_top":12,"aggregate_url":12,"aggregatealign":0,"aggregateauthresult":0,"aggregateauthresultdkim":0,"aggregateauthresultspf":0,"aggregateidentifi":0,"aggregateparsedreport":0,"aggregatepolicyevalu":0,"aggregatepolicyoverridereason":0,"aggregatepolicypublish":0,"aggregaterecord":0,"aggregatereport":0,"aggregatereportmetadata":0,"aggress":12,"alia":[0,12],"alias":12,"align":[5,7,10],"aliv":0,"allow":[2,3,8,12],"allow_unencrypted_storag":12,"allowremot":2,"alreadi":12,"alreadysav":0,"also":[0,2,3,6,7,8,12],"alter":[3,8],"altern":[5,12],"although":11,"alway":[0,2,4,12],"always_use_local_fil":[0,12],"amazon":5,"amd64":12,"amount":12,"analyt":[5,12],"analyz":12,"ani":[0,3,6,7,8,12],"anonym":10,"anoth":[6,12],"answer":[0,12],"apach":5,"api":[2,4,5,12],"api_key":[0,12],"app":12,"appear":12,"append":[0,12],"append_json":0,"appendix":10,"appid":12,"appli":12,"applic":12,"applicationaccesspolici":12,"approach":12,"approxim":2,"apt":[2,4,6],"archiv":[0,12],"archive_fold":[0,12],"argument":12,"arm64":12,"around":12,"array":0,"arriv":12,"arrival_d":10,"arrival_date_utc":[0,10],"artifact":4,"as_domain":[0,10],"as_nam":[0,10],"ask":3,"asmx":2,"asn":[0,6,10,12],"aspf":10,"assert":12,"assign":4,"associ":0,"assum":12,"assume_utc":0,"astimezon":0,"att":10,"attach":[0,3,8,10,12],"attachment_filenam":0,"attempt":[0,12],"attribut":6,"auth":[0,2,10,12],"auth_failur":10,"auth_method":12,"auth_mod":12,"auth_result":10,"auth_typ":[0,12],"authent":[0,2,3,4,7,12],"authentication_mechan":10,"authentication_result":10,"authentication_typ":12,"auto":2,"automat":[6,12],"avail":[6,12],"avoid":[7,12],"aw":[0,12],"aws_region":[0,12],"aws_servic":[0,12],"awssigv4":[0,12],"azur":[5,12],"b":10,"b2c":7,"back":[0,12],"backend":[0,12],"backfil":12,"backlog":12,"backward":12,"bare":12,"base":[0,2,3,4,6,7,8,10],"base64":0,"base_domain":[0,10],"basic":[0,2,12],"batch":12,"batch_siz":[0,12],"bcc":[0,10],"bd6e1bb5":10,"becaus":[2,3,7,8,12],"becom":12,"befor":[0,12],"begin_d":10,"behavior":0,"behind":6,"benefit":5,"best":[7,12],"beyond":0,"bin":[2,4,6,12],"binari":[0,12],"binaryio":0,"bind":2,"bindaddress":2,"blank":[3,8],"block":[2,12],"bodi":[0,3,8,10,12],"bool":[0,12],"boundari":[0,12],"box":12,"brand":[5,7],"break":[3,4,8],"broken":0,"browser":4,"bucket":12,"budget":0,"bug":5,"build":6,"built":0,"bundl":[0,6,7,12],"busi":7,"button":[3,8],"byte":0,"c":[10,12],"ca":[4,12],"cach":[0,12],"cafile_path":12,"call":[0,5,12],"callabl":0,"callback":0,"came":[3,8],"can":[0,2,3,4,5,6,7,8,12],"cap":[0,12],"carri":[0,6],"case":[2,3,8,12],"catch":[0,12],"caught":0,"caus":[3,4,7,8],"cc":[0,10],"center":7,"cento":[4,6],"cert":[4,12],"cert_path":12,"certain":[0,12],"certfile_path":12,"certif":[0,4,7,12],"certificate_password":12,"certificate_path":12,"cest":10,"chain":0,"chang":[4,7,11,12],"charact":[2,12],"charset":10,"chart":7,"check":[0,2,3,4,7,12],"check_timeout":[0,12],"checkbox":4,"checkdmarc":3,"chines":7,"chmod":[2,4,12],"choos":[3,8],"chown":[2,12],"ci":7,"cisco":12,"class":0,"clean":[0,12],"clear":0,"cli":[0,5],"click":[4,7],"client":[2,3,4,8,12],"client_assert":12,"client_id":12,"client_secret":12,"clientassert":12,"clientsecret":12,"clientsotimeout":2,"clock":0,"close":[0,12],"cloud":[0,12],"cloudflar":[0,12],"cluster":[4,12],"co":4,"code":[0,4,12],"collect":[7,12],"collector":[11,12],"com":[1,2,3,8,9,10,12],"come":[0,7],"comfort":12,"comma":[6,12],"command":[2,3,6,8,12],"comment":12,"commerci":[4,5],"common":[3,4,6,8],"communiti":[3,8],"compat":[0,7,12],"complet":[3,4,12],"compli":[3,4,6,8,9],"compliant":[3,8],"compon":6,"compress":5,"conf":6,"config":[0,2,6],"config_fil":12,"config_reload":0,"configur":[0,3,4,5,6,7,8,9],"configure_ipinfo_api":0,"conform":4,"connect":[0,2,4,12],"connection_str":12,"consid":[5,7],"consist":[0,5,10],"consol":[4,12],"constant":0,"consult":6,"consum":[7,12],"contact":7,"contain":[0,7,11,12],"content":[0,3,8,10,11,12],"contrib":6,"contribut":5,"control":[4,12],"convent":12,"convert":[0,3,8],"convert_outlook_msg":0,"copi":[0,6,11],"core":[3,8],"correct":[0,6,7,12],"correspond":12,"corrupt":0,"count":[2,7,10],"countri":[0,7,10,12],"country_cod":0,"cpan":6,"cr":12,"crash":[2,4,12],"creat":[0,2,3,4,6,8,12],"create_fold":0,"create_index":0,"creation":12,"creativ":6,"credenti":[6,12],"credentials_fil":12,"cron":6,"cross":0,"crt":4,"csr":4,"csv":[0,5,12],"ctrl":12,"cumul":6,"current":[0,2,4,12],"custom":[7,12],"d":[0,4,12],"daemon":[2,4,12],"daili":[0,12],"dashboard":[4,5,9,11],"dat":0,"data":[0,4,5,6,7,9,11,12],"databas":[0,12],"date":[0,3,8,10],"date_utc":10,"datetim":0,"davmail":5,"day":[0,4,9,12],"db_path":0,"dbip":[0,6,12],"dbname":12,"dce":12,"dcr":12,"dcr_aggregate_stream":12,"dcr_failure_stream":12,"dcr_immutable_id":12,"dcr_smtp_tls_stream":12,"dd":0,"de":10,"dearmor":4,"deb":4,"debian":[4,5,6],"debug":12,"decemb":6,"decod":0,"decode_base64":0,"dedic":6,"default":[0,2,4,5,6,7,12],"defens":5,"delay":[2,10,12],"deleg":12,"delegated_us":12,"delet":[0,2,4,12],"delivery_result":10,"demystifi":3,"depend":[0,4,5,12],"deploy":[3,8,12],"deprec":12,"describ":12,"descript":[2,6,12],"design":12,"destin":[0,12],"detail":[6,7,12],"dev":[6,12],"devel":6,"develop":5,"devicecod":12,"dict":0,"dictionari":0,"differ":[7,12],"difficult":12,"dig":0,"digest":[3,8],"dir":6,"direct":[7,12],"directori":[0,6,12],"dis":10,"disabl":[0,2,6,12],"disclaim":[3,8],"disk":[0,12],"display":[3,7,11],"display_nam":10,"disposit":[7,10],"distinguish":12,"distribut":6,"distro":6,"dkim":[5,7,8,10],"dkim_align":10,"dkim_domain":10,"dkim_result":10,"dkim_selector":10,"dkm":3,"dmarc":[0,4,6,8,9,10,11,12],"dmarc_aggreg":4,"dmarc_align":10,"dmarc_failur":4,"dmarc_moderation_act":[3,8],"dmarc_none_moderation_act":[3,8],"dmarc_quarantine_moderation_act":[3,8],"dmarcian":5,"dmarcresport":12,"dnf":6,"dns":[0,3,6,7,12],"dns_retri":0,"dns_test_address":12,"dns_timeout":[0,12],"dnspython":0,"doc":[9,12],"doctyp":10,"document":[0,2,12],"doe":[3,8,12],"domain":[0,4,7,8,10,12],"domainawar":[1,3,12],"don":3,"doubl":12,"download":[0,2,4,6,12],"downloaderror":0,"draft":[5,10],"dsn":12,"dtd":10,"dummi":12,"dure":[2,12],"e":[0,2,3,4,6,8,12],"e7":10,"earlier":[0,7],"easi":[4,9],"easier":[11,12],"echo":4,"edit":[2,6,12],"editor":11,"effect":12,"effici":4,"either":[5,12],"elast":[4,5,12],"elasticsearch":[0,5,12],"elasticsearcherror":0,"elig":12,"elk":12,"els":4,"email":[0,3,5,6,7,8,10,11,12],"email_result":0,"emailaddress":0,"emailattach":0,"emailparsererror":0,"empti":[0,3,8,12],"en":[3,4,8,10],"enabl":[2,4,12],"enableew":2,"enablekeepal":2,"enableproxi":2,"encod":[0,10,12],"encount":0,"encrypt":[4,12],"encryptedsavedobject":4,"encryptionkey":4,"end":[0,3,4,5,12],"end_dat":10,"endpoint":[5,12],"endpoint_url":12,"enforc":[3,8],"enough":12,"enrich":6,"enrol":4,"ensur":[3,6,8],"entir":[0,3,7,8,12],"entra":12,"entri":0,"envelop":3,"envelope_from":10,"envelope_to":10,"environ":[5,6],"eof":0,"eol":5,"epel":6,"error":[0,7,10,12],"es":[0,12],"escap":12,"especi":[7,12],"etc":[2,3,4,6,8,12],"even":[2,3,8,12],"event":[2,11,12],"everi":[0,2,6,7,12],"ew":5,"ex":12,"exact":[3,8],"exampl":[3,4,6,8,10],"except":[0,12],"exchang":[2,10,12],"exclud":2,"execreload":12,"execstart":[2,12],"exhaust":12,"exist":[0,3,4,8,12],"exit":[0,12],"expiri":7,"expiringdict":0,"explain":[3,8],"explicit":[0,3,6,8],"export":[4,7,12],"extra":12,"extract":[0,2],"extract_report":0,"extract_report_from_file_path":0,"eye":[2,12],"f":4,"factor":2,"fail":[0,3,7,8,10,12],"fail_on_output_error":12,"failed_session_count":10,"failov":0,"failur":[0,5,11,12],"failure_csv_filenam":[0,12],"failure_detail":10,"failure_index":0,"failure_json_filenam":[0,12],"failure_report":0,"failure_top":12,"failure_url":12,"failureparsedreport":0,"failurereport":0,"fall":[0,12],"fallback":0,"fals":[0,2,10,12],"fantast":[3,8],"faster":12,"fatal":[0,12],"featur":[4,12],"feedback":0,"feedback_report":0,"feedback_typ":10,"fetch":[0,7,12],"field":[0,4],"file":[0,2,5,6,7,11],"file_path":[0,12],"filenam":[0,12],"filename_safe_subject":10,"filepath":12,"fill":[4,6],"filter":[0,3,7,8,11],"final":5,"financ":12,"find":[3,7,8,12],"fine":[3,8],"finish":12,"first":[0,3,6,8,12],"first_strip_reply_to":[3,8],"fit":[3,8,12],"fix":4,"flag":[0,2,6,12],"flat":0,"flexibl":11,"flight":12,"float":[0,12],"flush":12,"fo":10,"fold":0,"folder":[0,2,12],"foldersizelimit":2,"follow":[2,4,5,12],"footer":[3,8],"forc":12,"foreground":12,"forens":[5,7,12],"forensicparsedreport":0,"forensicreport":0,"form":12,"format":[0,7,12],"former":[5,7,12],"forward":[3,7,8],"found":[0,6,12],"foundat":10,"fqdn":4,"fraud":5,"free":[6,12],"fresh":12,"freshest":12,"friend":7,"from_is_list":[3,8],"ftp_proxi":6,"full":12,"fulli":[3,8,12],"function":0,"g":[0,2,3,4,6,8,12],"gateway":2,"gb":4,"gcc":6,"gdpr":[4,9],"gelf":[5,12],"general":[3,6,8,12],"generat":[3,4,8,10],"geoip":[6,12],"geoipupd":6,"geolite2":5,"geoloc":[0,12],"get":[0,2,4,6,12],"get_base_domain":0,"get_dmarc_reports_from_mailbox":0,"get_dmarc_reports_from_mbox":0,"get_filename_safe_str":0,"get_ip_address_countri":0,"get_ip_address_db_record":0,"get_ip_address_info":0,"get_report_zip":0,"get_reverse_dn":0,"get_service_from_reverse_dns_base_domain":0,"ghcr":12,"github":[1,6,10,12],"give":[0,4],"given":[0,12],"glass":7,"gmail":[5,7,12],"gmail_api":12,"go":[0,3,8],"goe":[3,8],"googl":[7,12],"googleapi":12,"got":12,"gov":12,"gpg":4,"grafana":5,"grant":12,"graph":[2,5,7,12],"graph_url":12,"graylog":5,"group":[2,7,12],"guid":[4,5],"guidanc":12,"gzip":[0,5],"h":[0,12],"hamburg":4,"hand":[3,8],"handl":[5,12],"handler":7,"happen":0,"hard":12,"has_defect":10,"head":10,"header":[0,3,7,8,10,12],"header_from":10,"headless":2,"health":12,"healthcar":12,"heap":4,"heavi":[4,12],"hec":[0,11,12],"hecclient":0,"hectokengoesher":12,"help":5,"hh":0,"high":[7,12],"higher":[3,8],"histori":12,"hit":[0,12],"home":6,"hop":10,"host":[0,2,3,4,5,8,12],"hostnam":[0,12],"hour":[0,12],"hover":7,"href":10,"html":[3,4,8,10],"http":[0,2,4,5,6,10,11,12],"http_proxi":6,"https":[0,1,2,3,4,6,8,9,12],"https_proxi":6,"httpx":12,"human":[0,7],"human_timestamp":0,"human_timestamp_to_datetim":0,"human_timestamp_to_unix_timestamp":0,"hup":12,"icon":7,"id":[3,8,10,12],"ideal":[3,8],"ident":[3,8,12],"identifi":10,"idl":[0,2,12],"ignor":[0,12],"imag":12,"imap":[0,2,5,12],"imap_password":12,"imapalwaysapproxmsgs":2,"imapautoexpung":2,"imapcli":5,"imapidledelay":2,"imapport":2,"immedi":[2,12],"immut":12,"impli":12,"import":[4,7,12],"improv":12,"inbox":[0,3,5,8,12],"inc":10,"includ":[0,3,6,8,12],"include_list_post_head":[3,8],"include_rfc2369_head":[3,8],"include_sender_head":[3,8],"include_spam_trash":12,"incom":[7,12],"incorrect":12,"increas":[4,12],"increment":12,"indefinit":12,"indent":12,"index":[0,5,9,11,12],"index_prefix":[0,12],"index_prefix_domain_map":12,"index_suffix":[0,12],"indic":[3,5],"individu":12,"industri":12,"inform":[0,4,7,12],"infrequ":12,"ingest":12,"ini":[2,12],"initi":0,"inner":12,"input":0,"input_":0,"inspect":12,"instal":[2,5,12],"installed_app":12,"instanc":12,"instead":[0,3,6,8,12],"int":[0,12],"intend":[3,8],"interact":[2,4],"interakt":10,"interfer":[3,8],"interpret":[0,6],"interrupt":12,"interval":12,"interval_begin":10,"interval_end":10,"invalid":[0,12],"invalidaggregatereport":0,"invaliddmarcreport":0,"invalidfailurereport":0,"invalidforensicreport":0,"invalidipinfoapikey":0,"invalidsmtptlsreport":0,"involv":7,"io":[0,12],"ip":[0,3,4,7,12],"ip_address":[0,10],"ip_db_path":[0,6,12],"ip_db_url":12,"ipaddressinfo":0,"ipinfo":[0,6,12],"ipinfo_api_token":12,"ipinfo_url":12,"ipsourceinfo":0,"ipv4":0,"ipv6":0,"is_mbox":0,"is_outlook_msg":0,"iso":0,"issu":1,"java":2,"job":[3,6,8],"joe":[3,8],"journalctl":[2,12],"jre":2,"json":[0,5,12],"june":5,"just":7,"jvm":4,"jwt":12,"kafka":[5,12],"kb4099855":6,"kb4134118":6,"kb4295699":6,"keep":[0,12],"keep_al":0,"keepal":2,"key":[0,3,4,6,12],"keyfile_path":12,"keyout":4,"keyr":4,"keystor":4,"kibana":[5,11],"kill":12,"killsign":12,"kind":12,"know":3,"known":[0,3,7,8,12],"kubernet":12,"kwarg":0,"label":12,"languag":[3,8],"larg":[2,12],"larger":12,"last":6,"later":[4,6,12],"latest":[2,4,9,12],"layer":0,"layout":11,"leak":7,"least":[4,6,12],"leav":3,"left":7,"legaci":5,"legal":[3,8],"legitim":[7,12],"less":12,"level":[0,3,4,12],"lf":12,"libemail":6,"libpq":12,"librari":12,"libxml2":6,"libxslt":6,"licens":6,"life":5,"lifetim":0,"lifetimetimeout":0,"like":[0,3,6,8,12],"limit":[0,2,12],"line":[3,8,12],"link":[3,4,7,8],"linux":[3,6,8],"list":[0,2,4,5,7,12],"listen":[2,12],"lite":[0,6,12],"live":[7,12],"ll":[3,8],"load":[0,4,12],"load_ip_db":0,"load_psl_overrid":0,"load_reverse_dns_map":0,"local":[0,2,4,6,10,12],"local_file_path":0,"local_psl_overrides_path":12,"local_reverse_dns_map_path":12,"localhost":12,"locat":[7,12],"log":[0,2,5,12],"log_analyt":12,"log_fil":12,"logger":12,"login":4,"logstash":4,"long":[3,12],"longer":[3,6,8],"look":[0,3,7],"lookup":[0,12],"loop":0,"loopback":2,"loss":0,"lot":7,"low":12,"lower":12,"lua":10,"m":[0,6,12],"m365":12,"maco":6,"magnifi":7,"mail":[0,5,6,10,12],"mail_bcc":0,"mail_cc":0,"mail_from":0,"mail_to":0,"mailbox":[0,7,12],"mailbox_check_timeout":12,"mailbox_connect":0,"mailboxconnect":0,"maildir":12,"maildir_cr":12,"maildir_path":12,"mailer":10,"mailrelay":10,"mailto":6,"main":4,"mainpid":12,"maintain":5,"make":[0,3,4,6,8,9,12],"malici":[7,12],"manag":[4,7,12],"mandatori":12,"manual":12,"map":0,"mariadb":12,"market":7,"massiv":12,"match":[0,4,11,12],"max_ag":10,"max_shards_per_nod":12,"maximum":4,"maxmind":[0,5,12],"may":[5,7,12],"mbox":[0,12],"mean":12,"mechan":3,"member":[3,8],"memori":12,"mention":7,"menu":[4,7],"merg":0,"messag":[0,2,3,4,6,7,8,10,12],"message_id":10,"meta":10,"method":12,"mfrom":10,"microsoft":[2,5,10,12],"mid":12,"might":[0,3,7,8],"migrat":[0,7,12],"migrate_index":0,"mime":10,"min":0,"minimum":4,"minut":[0,2,12],"mirror":0,"miss":[6,12],"mitig":[3,8],"mix":0,"mm":0,"mmdb":[0,6,12],"mobil":[3,8],"mode":[0,2,4,6,10],"modern":[2,3,8],"modifi":[0,3,8,12],"modul":[0,5,6,12],"mon":10,"monitor":[3,12],"month":[0,12],"monthly_index":[0,12],"mous":7,"move":[0,4,12],"ms":[0,10,12],"msg":[0,6],"msg_byte":0,"msg_date":0,"msg_footer":[3,8],"msg_header":[3,8],"msgconvert":[0,6],"msgraph":12,"mta":7,"much":12,"multi":[2,5],"multipl":[0,12],"mung":[3,8],"must":[2,3,8,12],"mutual":[4,12],"mv":4,"mx":10,"n":[0,10,12],"n_proc":12,"naiv":0,"name":[0,3,4,7,10,11],"nameserv":[0,12],"nano":[2,12],"nation":12,"navig":[3,8],"ncontent":10,"ndate":10,"ndjson":[4,7],"need":[0,2,3,4,6,7,8,12],"neither":12,"nelson":[3,8],"net":[2,12],"network":[0,2,4,12],"never":12,"new":[0,2,5,6,7,12],"newer":6,"newest":[2,12],"newkey":4,"news":3,"next":[0,12],"nfrom":10,"nmessag":10,"nmime":10,"node":4,"nologin":6,"non":[0,3,8,12],"nonameserv":0,"none":[0,3,10,12],"noproxyfor":2,"norepli":[3,10],"normal":[0,10,12],"normalize_timespan_threshold_hour":0,"normalized_timespan":10,"nosecureimap":2,"notabl":7,"note":12,"notic":12,"now":[4,6,7],"nsubject":10,"nto":10,"null":[6,10],"number":[0,12],"number_of_replica":[0,12],"number_of_shard":[0,12],"nwettbewerb":10,"nx":10,"o":[2,4,12],"oR":6,"oauth2":12,"oauth2_port":12,"object":[0,4,7],"observ":[7,12],"occur":[0,7],"occurr":11,"oct":10,"offic":2,"office365":2,"offici":12,"offlin":[0,6,12],"offset":0,"often":[7,12],"old":7,"older":[6,10],"oldest":[2,12],"ole":[0,6],"onc":12,"ondmarc":5,"one":[0,3,5,6,8,12],"onli":[0,2,3,6,7,8],"onlin":[0,2,12],"onto":0,"oor":0,"open":[0,3],"opendn":12,"opensearch":[5,7,12],"opensearch_dashboard":7,"opensearcherror":0,"openssl":4,"oper":12,"opt":[2,6,12],"option":[0,2,3,4,5,8,11,12],"order":12,"org":[0,6,9,10,12],"org_email":10,"org_extra_contact_info":10,"org_nam":10,"organiz":[2,5,7,12],"organization_nam":10,"origin":[3,8,12],"original_envelope_id":10,"original_mail_from":10,"original_rcpt_to":10,"original_timespan_second":10,"os":0,"oserror":0,"otherwis":[0,12],"outdat":7,"outgo":[3,8,12],"outlook":[0,2,6],"output":[0,5,12],"output_directori":0,"outsid":12,"overal":0,"overrid":[0,6,12],"overwrit":[0,4],"owa":5,"owned":6,"ownership":6,"p":[3,10],"p12":4,"pack":4,"packag":[0,4,6],"packet":0,"pad":0,"page":[3,4,6,7,8],"paginate_messag":12,"pan":10,"parallel":12,"paramet":[0,12],"parent":7,"pars":[0,3,5,6,10,12],"parse_aggregate_report_fil":0,"parse_aggregate_report_xml":0,"parse_email":0,"parse_failure_report":0,"parse_forensic_report":0,"parse_report_email":0,"parse_report_fil":0,"parse_smtp_tls_report_json":0,"parsed_aggregate_reports_to_csv":0,"parsed_aggregate_reports_to_csv_row":0,"parsed_failure_reports_to_csv":0,"parsed_failure_reports_to_csv_row":0,"parsed_forensic_reports_to_csv":0,"parsed_forensic_reports_to_csv_row":0,"parsed_sampl":10,"parsed_smtp_tls_reports_to_csv":0,"parsed_smtp_tls_reports_to_csv_row":0,"parsedemail":0,"parsedmarc":[4,9,10,11],"parsedmarc_":12,"parsedmarc_config_fil":12,"parsedmarc_debug":12,"parsedmarc_elasticsearch_":12,"parsedmarc_elasticsearch_host":12,"parsedmarc_elasticsearch_ssl":12,"parsedmarc_gelf_":12,"parsedmarc_general_":12,"parsedmarc_general_debug":12,"parsedmarc_general_ipinfo_api_token":12,"parsedmarc_general_ipinfo_url":12,"parsedmarc_general_offlin":12,"parsedmarc_general_save_aggreg":12,"parsedmarc_general_save_failur":12,"parsedmarc_gmail_api_":12,"parsedmarc_gmail_api_credentials_file_fil":12,"parsedmarc_imap_":12,"parsedmarc_imap_host":12,"parsedmarc_imap_password":12,"parsedmarc_imap_password_fil":12,"parsedmarc_imap_us":12,"parsedmarc_kafka_":12,"parsedmarc_log_analytics_":12,"parsedmarc_mailbox_":12,"parsedmarc_mailbox_watch":12,"parsedmarc_maildir_":12,"parsedmarc_msgraph_":12,"parsedmarc_opensearch_":12,"parsedmarc_s3_":12,"parsedmarc_smtp_":12,"parsedmarc_splunk_hec_":12,"parsedmarc_splunk_hec_index":12,"parsedmarc_splunk_hec_token":12,"parsedmarc_splunk_hec_url":12,"parsedmarc_syslog_":12,"parsedmarc_webhook_":12,"parser":0,"parsererror":0,"parsingresult":0,"part":[3,4,7,8],"particular":[7,12],"pass":[0,3,7,10,12],"passag":7,"passsword":12,"password":[0,4,6,12],"paste":[4,11],"patch":6,"path":[0,4,6,12],"pathlik":0,"pattern":[0,5,7],"payload":[0,12],"pct":10,"peak":12,"pem":12,"per":[0,7,12],"percentag":7,"perform":[2,5],"period":12,"perl":[0,6],"permiss":[4,12],"persist":12,"peter":10,"pick":[6,12],"pickup":6,"pid":12,"pie":7,"pip":[6,12],"pkcs12":12,"place":[0,4,7,12],"plain":[0,12],"plaintext":[3,8],"platform":[3,6,8,12],"pleas":[1,5,12],"plug":12,"plus":[7,12],"point":[6,12],"polici":[3,7,8,10,12],"policy_domain":10,"policy_evalu":10,"policy_override_com":10,"policy_override_reason":10,"policy_publish":10,"policy_str":10,"policy_typ":10,"policyscopegroupid":12,"poll":[0,2,12],"popul":0,"port":[0,2,12],"posit":[0,12],"posix":0,"possibl":12,"post":[3,8,12],"poster":[3,8],"postgr":12,"postgresql":[5,12],"postorius":[3,8],"powershel":12,"ppa":6,"practic":12,"pre":[6,12],"prebuilt":12,"predict":12,"prefer":[2,6,12],"prefix":[0,3,8,12],"premad":[5,11],"prerequisit":5,"present":12,"pressur":12,"pretti":12,"prettifi":12,"previous":[0,2,4,6,12],"pri":[2,12],"primari":0,"print":12,"printabl":10,"prioriti":12,"privaci":[3,6,7,8,12],"privat":12,"probe":0,"problem":12,"proc":12,"process":[0,2,5,6,12],"produc":[0,10],"program":12,"programdata":6,"progress":12,"project":[0,2,3,5,11,12],"prompt":4,"proofpoint":5,"properti":2,"protect":[2,3,5,8,12],"protocol":12,"provid":[0,4,7,12],"prox":6,"proxi":2,"proxyhost":2,"proxypassword":2,"proxyport":2,"proxyus":2,"psl":[0,12],"psl_overrid":0,"psl_overrides_path":0,"psl_overrides_url":[0,12],"psycopg":12,"public":[0,3,10,12],"public_suffix_list":0,"publicbaseurl":4,"publicsuffix":0,"publish":[3,12],"pull":12,"put":[4,12],"python":[0,6],"python3":6,"qo":4,"quarantin":[3,8],"queri":[0,12],"query_dn":0,"quick":0,"quickstart":12,"quit":12,"quot":10,"quota":[0,12],"r":[2,10,12],"rais":[0,12],"ram":[4,12],"rate":[0,12],"rather":[3,8,12],"raw":12,"re":[6,12],"read":[0,12],"readabl":[0,12],"readwrit":12,"realli":3,"reason":[0,2,4,5,12],"receiv":[0,7,10,12],"receiving_ip":10,"receiving_mx_hostnam":10,"recent":0,"recipi":7,"recogn":7,"recommend":12,"recommended_dns_nameserv":0,"record":[0,5,6,10],"record_typ":0,"redact":12,"redi":12,"reduc":[6,12],"refer":[4,5],"referenc":12,"refresh":[6,12],"refresh_interv":12,"regard":12,"regardless":[0,10],"region":[0,12],"region_nam":12,"regist":6,"registr":12,"regul":[4,6,9,12],"regular":[3,8],"reject":[0,3,8,12],"relat":[3,12],"relay":[3,8],"releas":[4,6],"reli":[6,7],"reliabl":12,"reload":[0,2,4],"remain":[0,7,12],"remot":2,"remov":[0,3,4,8,12],"repeat":[0,3,8],"replac":[0,3,4,8,12],"repli":[2,3,8],"replic":12,"replica":[0,12],"reply_goes_to_list":[3,8],"reply_to":10,"replyto":[3,8],"repopul":0,"report":[0,4,11,12],"report_id":10,"report_metadata":10,"report_typ":0,"reported_domain":10,"reports_fold":[0,12],"repositori":[6,11],"req":4,"request":[0,2,4,12],"requir":[0,2,3,4,5,6,8,12],"require_encrypt":0,"reserv":12,"resid":12,"resolv":[0,12],"resort":6,"resourc":[0,4,5,12],"respons":[0,12],"rest":[0,12],"restart":[2,3,4,6,8],"restartsec":[2,12],"restor":4,"restrict":12,"restrictaccess":12,"result":[0,5,7,10,12],"result_typ":10,"resum":12,"retain":[3,8,12],"retent":5,"retri":[0,12],"retriev":2,"retry_attempt":12,"retry_delay":12,"return":0,"revers":[0,6,7,12],"reverse_dn":[0,10],"reverse_dns_base_domain":0,"reverse_dns_map":0,"reverse_dns_map_path":0,"reverse_dns_map_url":[0,12],"reversednsservic":0,"review":7,"rewrit":[0,3,8],"rfc":[0,3,5,8,10],"rfc2369":[3,8],"rfc822":2,"rhel":[4,5,6],"right":[4,7],"rm":4,"ro":0,"rocki":6,"rollup":6,"root":[2,12],"rough":12,"rpm":4,"rpt":[5,7],"rsa":4,"rua":[5,6],"ruf":[5,6,7,12],"rule":[7,12],"run":[0,4,5,6],"rw":[2,12],"s":[0,2,3,4,6,7,8,10,12],"s3":[5,12],"safe":0,"safer":12,"sampl":[0,5,7,12],"sample_headers_on":10,"save":[0,4,6,7,12],"save_aggreg":12,"save_aggregate_report_to_elasticsearch":0,"save_aggregate_report_to_opensearch":0,"save_aggregate_reports_to_splunk":0,"save_failur":12,"save_failure_report_to_elasticsearch":0,"save_failure_report_to_opensearch":0,"save_failure_reports_to_splunk":0,"save_forens":12,"save_forensic_report_to_elasticsearch":0,"save_forensic_report_to_opensearch":0,"save_forensic_reports_to_splunk":0,"save_output":0,"save_smtp_tl":12,"save_smtp_tls_report_to_elasticsearch":0,"save_smtp_tls_report_to_opensearch":0,"save_smtp_tls_reports_to_splunk":0,"sbin":6,"schedul":[6,12],"schema":[5,10,12],"scope":[10,12],"script":6,"scrub_nondigest":[3,8],"sdk":12,"search":[0,3,8,12],"second":[0,2,12],"secret_access_key":12,"secur":[0,4,12],"see":[2,3,4,6,7,12],"seek":0,"segment":7,"select":0,"selector":10,"self":[4,5],"send":[0,2,3,4,5,7,8,11,12],"sender":[5,7,8],"sending_mta_ip":10,"sensit":12,"sent":[3,8,12],"sentinel":5,"separ":[0,3,4,6,7,9,11,12],"sequenc":0,"server":[0,2,3,4,5,6,7,10,12],"server_ip":4,"serverless":[0,12],"servernameon":10,"servic":[0,3,4,5,6,7,8,10],"service_account":12,"service_account_us":12,"session":[0,7],"set":[0,2,3,4,6,7,8,9,12],"set_host":0,"setup":[4,6,9,12],"shard":[0,12],"share":[4,6,12],"sharealik":6,"sharepoint":10,"shell":6,"ship":[6,12],"short":12,"shot":12,"shouldn":[3,8],"show":[2,7,12],"shown":[6,12],"shutdown":[0,12],"side":[7,12],"sighup":[0,6,12],"sigkil":12,"sign":[0,3,4,6,12],"signal":12,"signatur":[3,7,8],"sigterm":[0,12],"sigv4":[0,12],"silent":[6,12],"similar":7,"simpl":5,"simplifi":0,"sinc":[0,6,12],"singl":[0,12],"sink":12,"sister":3,"size":[2,4],"skel":6,"skip":[0,12],"skip_certificate_verif":[0,12],"slight":11,"slow":0,"small":[4,12],"smaller":12,"smtp":[0,3,5,12],"smtp_tls":[0,12],"smtp_tls_csv_filenam":[0,12],"smtp_tls_json_filenam":[0,12],"smtp_tls_report":0,"smtp_tls_url":12,"smtptlsfailuredetail":0,"smtptlsfailuredetailsopt":0,"smtptlsparsedreport":0,"smtptlspolici":0,"smtptlspolicysummari":0,"smtptlsreport":0,"socket":2,"solut":6,"someon":4,"sometim":12,"sort":[7,12],"sourc":[0,3,4,6,7,10],"source_as_domain":10,"source_as_nam":10,"source_asn":10,"source_base_domain":10,"source_countri":10,"source_ip_address":10,"source_nam":10,"source_reverse_dn":10,"source_typ":10,"sourceforg":2,"sp":[3,10],"spam":12,"special":12,"specif":[3,6,7,12],"specifi":[2,3],"spf":[7,10],"spf_align":10,"spf_domain":10,"spf_result":10,"spf_scope":10,"splunk":[5,12],"splunk_hec":12,"splunkerror":0,"splunkhec":12,"sponsor":5,"spoof":[3,8],"ss":0,"ssl":[0,2,4,12],"ssl_cert_path":0,"stabl":4,"stack":[4,7,12],"standard":[0,5,6,10],"start":[0,2,4,7,9,11,12],"starttl":[7,12],"startup":6,"static":12,"status":[2,12],"stay":7,"stdout":12,"step":[3,4,6,8],"still":[0,3,8,10,12],"stop":12,"storag":[0,12],"store":[2,4,9,12],"str":[0,12],"straight":12,"stream":12,"string":[0,12],"strip":[0,3,8,12],"strip_attachment_payload":[0,12],"strong":12,"structur":5,"sts":[7,10,12],"stsv1":10,"style":0,"subdomain":[0,3,12],"subject":[0,3,8,10,12],"subject_prefix":[3,8],"subsidiari":7,"substitut":6,"success":12,"successful_session_count":10,"sudo":[2,4,6,12],"suffix":0,"suggest":7,"suit":12,"suitabl":0,"summari":[3,8,12],"supervis":12,"suppli":[0,7,12],"support":[2,5,7,10,11],"sure":4,"surfac":[7,12],"sw50zxjha3rpdmugv2v0dgjld2vyymvylcocymvyc2ljahq":10,"switch":7,"syslog":[2,5,12],"system":[2,3,4,6,8,12],"systemctl":[2,4,12],"systemd":5,"systemdr":6,"t":[5,8,10,12],"tab":[3,4,8],"tabl":[5,7,12],"tag":6,"take":[0,12],"target":[0,2,12],"task":6,"tbi":10,"tcp":12,"tee":4,"tell":[3,7,8],"templat":[3,8],"temporari":7,"tenant":5,"tenant_id":12,"term":6,"test":[0,10,12],"text":[0,10],"thank":10,"therebi":[3,8],"thousand":12,"three":7,"throughput":12,"tier":12,"time":[0,2,4,6,7,12],"timeout":[0,2,12],"timeoutstopsec":12,"timespan":0,"timespan_requires_norm":10,"timestamp":0,"timestamp_to_datetim":0,"timestamp_to_human":0,"timezon":10,"tld":3,"tls":[0,5,12],"to_domain":10,"to_utc":0,"togeth":[7,12],"token":[0,4,12],"token_fil":12,"tool":12,"top":[3,7],"topic":12,"touch":[3,8],"tracker":1,"trade":12,"tradit":[3,8],"trail":12,"transfer":10,"transient":0,"transpar":5,"transport":[4,12],"trash":12,"treat":0,"tri":[0,12],"troubleshoot":12,"true":[0,2,4,10,12],"trust":12,"truststor":4,"tuesday":6,"tune":5,"two":6,"txt":[0,12],"type":[5,7,10,12],"typic":12,"typo":12,"u":[2,6,12],"ubuntu":[4,6],"udp":[0,12],"ui":[3,8],"unchang":[0,12],"uncondit":[3,8],"underlying":[0,12],"underneath":7,"underscor":12,"understand":[5,7],"unencrypt":12,"unexpir":12,"unfortun":[3,8],"unit":[0,2,12],"unix":0,"unknown":0,"unless":[6,12],"unreach":12,"unread":12,"unrel":6,"unsubscrib":[3,8],"unzip":2,"updat":[0,4,6,12],"upersecur":12,"upgrad":[2,5,6,12],"upload":12,"upper":7,"uppercas":12,"uri":[6,12],"url":[0,2,12],"us":10,"usabl":12,"usag":12,"use":[0,3,4,5,8,10],"use_ssl":0,"user":[0,2,3,4,6,7,8,10,12],"user_ag":10,"useradd":[2,6],"usernam":[0,12],"usernamepassword":12,"usesystemproxi":2,"usr":[4,6],"utc":0,"utf":10,"util":5,"v":12,"valid":[0,7,10,12],"valimail":5,"valu":[0,3,4,7,8,12],"var":[3,8,12],"variabl":5,"variant":12,"various":6,"vendor":3,"venv":[6,12],"verbos":12,"veri":[4,7,12],"verif":[0,4,12],"verifi":0,"verification_mod":4,"version":[0,2,4,5,9,10,11,12],"vew":2,"via":[0,2],"view":[7,12],"vim":4,"virtualenv":6,"visual":[4,9],"volum":[7,12],"vulner":3,"w":[0,12],"w3c":10,"wait":[0,12],"wall":0,"want":[2,12],"wantedbi":[2,12],"warn":12,"watch":[0,2,4,6,12],"watch_inbox":0,"watcher":[0,12],"way":[0,4,7],"web":[2,4],"webdav":2,"webhook":[5,12],"webmail":[3,7,8],"week":[0,6,12],"well":[2,12],"wettbewerb":10,"wget":4,"whalensolut":12,"wheel":12,"whenev":[0,2,12],"wherea":7,"wherev":12,"whether":0,"whi":[3,7,12],"whole":0,"whose":12,"wide":[6,10,12],"wiki":10,"will":[0,2,3,4,6,7,8,12],"win":12,"window":[6,12],"within":0,"without":[3,4,6,7,8],"won":5,"work":[2,3,5,6,7,8,12],"worker":12,"workstat":2,"worst":[3,12],"wrap":[3,8],"wrapper":12,"write":[0,12],"written":12,"www":[4,6,12],"x":[4,7,10],"x509":4,"xennn":10,"xml":[0,11],"xml_schema":10,"xms4g":4,"xmx4g":4,"xpack":4,"xxxx":4,"y":[4,6],"yahoo":7,"yaml":12,"year":12,"yes":[3,8],"yet":3,"yml":4,"yyyi":0,"zero":12,"zip":[0,2,5,12],"\u00fcbersicht":10},"titles":["API reference","Contributing to parsedmarc","Accessing an inbox using OWA/EWS","Understanding DMARC","Elasticsearch and Kibana","parsedmarc documentation - Open source DMARC report analyzer and visualizer","Installation","Using the Kibana dashboards","What about mailing lists?","OpenSearch and Grafana","Sample outputs","Splunk","Using parsedmarc"],"titleterms":{"Do":[3,8],"What":[3,8],"_file":12,"access":2,"aggreg":[7,10],"align":3,"analyz":[5,6],"api":0,"best":[3,8],"bug":1,"cli":12,"compat":5,"compos":12,"config":12,"configur":[2,12],"content":5,"contribut":1,"countri":6,"csv":10,"dashboard":7,"databas":6,"davmail":2,"depend":6,"dkim":3,"dmarc":[3,5,7],"docker":12,"document":5,"domain":3,"elast":0,"elasticsearch":4,"env":12,"environ":12,"ew":2,"exampl":12,"exchang":6,"failur":[7,10],"featur":5,"file":12,"geolite2":6,"grafana":9,"guid":3,"help":12,"inbox":2,"index":4,"indic":0,"instal":[4,6,9],"ip":6,"json":10,"kibana":[4,7],"list":[3,8],"listserv":[3,8],"lookalik":3,"mail":[3,8],"mailman":[3,8],"map":12,"maxmind":6,"microsoft":6,"mode":12,"multi":12,"multipl":6,"name":12,"onli":12,"open":5,"opensearch":[0,9],"option":6,"output":10,"owa":2,"parsedmarc":[0,1,2,5,6,12],"pattern":4,"perform":12,"practic":[3,8],"prerequisit":6,"proxi":6,"python":5,"record":[3,4,9],"refer":0,"reload":12,"report":[1,5,6,7,10],"resourc":3,"restart":12,"retent":[4,9],"run":[2,12],"sampl":10,"secret":12,"section":12,"sender":3,"servic":[2,12],"smtp":[7,10],"sourc":5,"specifi":12,"spf":3,"splunk":[0,11],"suffix":12,"support":[3,12],"systemd":[2,12],"t":3,"tabl":0,"tenant":12,"test":6,"tls":[7,10],"tune":12,"type":0,"understand":3,"upgrad":4,"use":[2,6,7,12],"util":0,"valid":3,"variabl":12,"via":12,"visual":5,"web":6,"without":12,"won":3,"workaround":[3,8]}}) \ No newline at end of file +Search.setIndex({"alltitles":{"API reference":[[0,null]],"Accessing an inbox using OWA/EWS":[[2,null]],"Bug reports":[[1,"bug-reports"]],"CLI help":[[12,"cli-help"]],"CSV aggregate report":[[10,"csv-aggregate-report"]],"CSV failure report":[[10,"csv-failure-report"]],"Configuration file":[[12,"configuration-file"]],"Configuring parsedmarc for DavMail":[[2,"configuring-parsedmarc-for-davmail"]],"Contents":[[5,null]],"Contributing to parsedmarc":[[1,null]],"DMARC Alignment Guide":[[3,"dmarc-alignment-guide"]],"DMARC aggregate reports":[[7,"dmarc-aggregate-reports"]],"DMARC failure reports":[[7,"dmarc-failure-reports"]],"DMARC guides":[[3,"dmarc-guides"]],"Do":[[3,"do"],[8,"do"]],"Do not":[[3,"do-not"],[8,"do-not"]],"Docker Compose example":[[12,"docker-compose-example"]],"Docker secrets (_FILE suffix)":[[12,"docker-secrets-file-suffix"]],"Elasticsearch and Kibana":[[4,null]],"Environment variable configuration":[[12,"environment-variable-configuration"]],"Examples":[[12,"examples"]],"Features":[[5,"features"]],"IP-to-country database":[[6,"ip-to-country-database"]],"Indices and tables":[[0,"indices-and-tables"]],"Installation":[[4,"installation"],[6,null],[9,"installation"]],"Installing parsedmarc":[[6,"installing-parsedmarc"]],"JSON SMTP TLS report":[[10,"json-smtp-tls-report"]],"JSON aggregate report":[[10,"json-aggregate-report"]],"JSON failure report":[[10,"json-failure-report"]],"LISTSERV":[[3,"listserv"],[8,"listserv"]],"Lookalike domains":[[3,"lookalike-domains"]],"Mailing list best practices":[[3,"mailing-list-best-practices"],[8,"mailing-list-best-practices"]],"Mailman 2":[[3,"mailman-2"],[3,"id1"],[8,"mailman-2"],[8,"id1"]],"Mailman 3":[[3,"mailman-3"],[3,"id2"],[8,"mailman-3"],[8,"id2"]],"Multi-tenant support":[[12,"multi-tenant-support"]],"OpenSearch and Grafana":[[9,null]],"Optional dependencies":[[6,"optional-dependencies"]],"Performance tuning":[[12,"performance-tuning"]],"Prerequisites":[[6,"prerequisites"]],"Python Compatibility":[[5,"python-compatibility"]],"Records retention":[[4,"records-retention"],[9,"records-retention"]],"Reloading configuration without restarting":[[12,"reloading-configuration-without-restarting"]],"Resources":[[3,"resources"]],"Running DavMail as a systemd service":[[2,"running-davmail-as-a-systemd-service"]],"Running parsedmarc as a systemd service":[[12,"running-parsedmarc-as-a-systemd-service"]],"Running without a config file (env-only mode)":[[12,"running-without-a-config-file-env-only-mode"]],"SMTP TLS reporting":[[7,"smtp-tls-reporting"]],"SPF and DMARC record validation":[[3,"spf-and-dmarc-record-validation"]],"Sample aggregate report output":[[10,"sample-aggregate-report-output"]],"Sample failure report output":[[10,"sample-failure-report-output"]],"Sample outputs":[[10,null]],"Section name mapping":[[12,"section-name-mapping"]],"Specifying the config file via environment variable":[[12,"specifying-the-config-file-via-environment-variable"]],"Splunk":[[11,null]],"Testing multiple report analyzers":[[6,"testing-multiple-report-analyzers"]],"Understanding DMARC":[[3,null]],"Upgrading Kibana index patterns":[[4,"upgrading-kibana-index-patterns"]],"Using MaxMind GeoLite2 (optional)":[[6,"using-maxmind-geolite2-optional"]],"Using Microsoft Exchange":[[6,"using-microsoft-exchange"]],"Using a web proxy":[[6,"using-a-web-proxy"]],"Using parsedmarc":[[12,null]],"Using the Kibana dashboards":[[7,null]],"What about mailing lists?":[[3,"what-about-mailing-lists"],[8,null]],"What if a sender won\u2019t support DKIM/DMARC?":[[3,"what-if-a-sender-wont-support-dkim-dmarc"]],"Workarounds":[[3,"workarounds"],[8,"workarounds"]],"parsedmarc":[[0,"module-parsedmarc"]],"parsedmarc documentation - Open source DMARC report analyzer and visualizer":[[5,null]],"parsedmarc.elastic":[[0,"module-parsedmarc.elastic"]],"parsedmarc.opensearch":[[0,"module-parsedmarc.opensearch"]],"parsedmarc.splunk":[[0,"module-parsedmarc.splunk"]],"parsedmarc.types":[[0,"module-parsedmarc.types"]],"parsedmarc.utils":[[0,"module-parsedmarc.utils"]]},"docnames":["api","contributing","davmail","dmarc","elasticsearch","index","installation","kibana","mailing-lists","opensearch","output","splunk","usage"],"envversion":{"sphinx":66,"sphinx.domains.c":3,"sphinx.domains.changeset":1,"sphinx.domains.citation":1,"sphinx.domains.cpp":9,"sphinx.domains.index":1,"sphinx.domains.javascript":3,"sphinx.domains.math":2,"sphinx.domains.python":4,"sphinx.domains.rst":2,"sphinx.domains.std":2,"sphinx.ext.todo":2,"sphinx.ext.viewcode":1},"filenames":["api.md","contributing.md","davmail.md","dmarc.md","elasticsearch.md","index.md","installation.md","kibana.md","mailing-lists.md","opensearch.md","output.md","splunk.md","usage.md"],"indexentries":{"aggregatealignment (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAlignment",false]],"aggregateauthresultdkim (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResultDKIM",false]],"aggregateauthresults (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResults",false]],"aggregateauthresultspf (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateAuthResultSPF",false]],"aggregateidentifiers (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateIdentifiers",false]],"aggregateparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateParsedReport",false]],"aggregatepolicyevaluated (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyEvaluated",false]],"aggregatepolicyoverridereason (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyOverrideReason",false]],"aggregatepolicypublished (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregatePolicyPublished",false]],"aggregaterecord (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateRecord",false]],"aggregatereport (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateReport",false]],"aggregatereportmetadata (class in parsedmarc.types)":[[0,"parsedmarc.types.AggregateReportMetadata",false]],"alreadysaved":[[0,"parsedmarc.elastic.AlreadySaved",false],[0,"parsedmarc.opensearch.AlreadySaved",false]],"append_json() (in module parsedmarc)":[[0,"parsedmarc.append_json",false]],"close() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.close",false]],"configure_ipinfo_api() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.configure_ipinfo_api",false]],"convert_outlook_msg() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.convert_outlook_msg",false]],"create_indexes() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.create_indexes",false]],"create_indexes() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.create_indexes",false]],"decode_base64() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.decode_base64",false]],"downloaderror":[[0,"parsedmarc.utils.DownloadError",false]],"elasticsearcherror":[[0,"parsedmarc.elastic.ElasticsearchError",false]],"email_results() (in module parsedmarc)":[[0,"parsedmarc.email_results",false]],"email_results_via_msgraph() (in module parsedmarc)":[[0,"parsedmarc.email_results_via_msgraph",false]],"emailaddress (class in parsedmarc.types)":[[0,"parsedmarc.types.EmailAddress",false]],"emailattachment (class in parsedmarc.types)":[[0,"parsedmarc.types.EmailAttachment",false]],"emailparsererror":[[0,"parsedmarc.utils.EmailParserError",false]],"extract_report() (in module parsedmarc)":[[0,"parsedmarc.extract_report",false]],"extract_report_from_file_path() (in module parsedmarc)":[[0,"parsedmarc.extract_report_from_file_path",false]],"failureparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.FailureParsedReport",false]],"failurereport (class in parsedmarc.types)":[[0,"parsedmarc.types.FailureReport",false]],"forensicparsedreport (in module parsedmarc.types)":[[0,"parsedmarc.types.ForensicParsedReport",false]],"forensicreport (in module parsedmarc.types)":[[0,"parsedmarc.types.ForensicReport",false]],"get_base_domain() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_base_domain",false]],"get_dmarc_reports_from_mailbox() (in module parsedmarc)":[[0,"parsedmarc.get_dmarc_reports_from_mailbox",false]],"get_dmarc_reports_from_mbox() (in module parsedmarc)":[[0,"parsedmarc.get_dmarc_reports_from_mbox",false]],"get_filename_safe_string() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_filename_safe_string",false]],"get_ip_address_country() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_country",false]],"get_ip_address_db_record() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_db_record",false]],"get_ip_address_info() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_ip_address_info",false]],"get_report_zip() (in module parsedmarc)":[[0,"parsedmarc.get_report_zip",false]],"get_reverse_dns() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_reverse_dns",false]],"get_service_from_reverse_dns_base_domain() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.get_service_from_reverse_dns_base_domain",false]],"hecclient (class in parsedmarc.splunk)":[[0,"parsedmarc.splunk.HECClient",false]],"human_timestamp_to_datetime() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.human_timestamp_to_datetime",false]],"human_timestamp_to_unix_timestamp() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.human_timestamp_to_unix_timestamp",false]],"invalidaggregatereport":[[0,"parsedmarc.InvalidAggregateReport",false]],"invaliddmarcreport":[[0,"parsedmarc.InvalidDMARCReport",false]],"invalidfailurereport":[[0,"parsedmarc.InvalidFailureReport",false]],"invalidforensicreport (in module parsedmarc)":[[0,"parsedmarc.InvalidForensicReport",false]],"invalidipinfoapikey":[[0,"parsedmarc.utils.InvalidIPinfoAPIKey",false]],"invalidsmtptlsreport":[[0,"parsedmarc.InvalidSMTPTLSReport",false]],"ipaddressinfo (class in parsedmarc.utils)":[[0,"parsedmarc.utils.IPAddressInfo",false]],"ipsourceinfo (class in parsedmarc.types)":[[0,"parsedmarc.types.IPSourceInfo",false]],"is_mbox() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.is_mbox",false]],"is_outlook_msg() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.is_outlook_msg",false]],"load_ip_db() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_ip_db",false]],"load_psl_overrides() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_psl_overrides",false]],"load_reverse_dns_map() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.load_reverse_dns_map",false]],"migrate_indexes() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.migrate_indexes",false]],"migrate_indexes() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.migrate_indexes",false]],"module":[[0,"module-parsedmarc",false],[0,"module-parsedmarc.elastic",false],[0,"module-parsedmarc.opensearch",false],[0,"module-parsedmarc.splunk",false],[0,"module-parsedmarc.types",false],[0,"module-parsedmarc.utils",false]],"opensearcherror":[[0,"parsedmarc.opensearch.OpenSearchError",false]],"parse_aggregate_report_file() (in module parsedmarc)":[[0,"parsedmarc.parse_aggregate_report_file",false]],"parse_aggregate_report_xml() (in module parsedmarc)":[[0,"parsedmarc.parse_aggregate_report_xml",false]],"parse_email() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.parse_email",false]],"parse_failure_report() (in module parsedmarc)":[[0,"parsedmarc.parse_failure_report",false]],"parse_forensic_report() (in module parsedmarc)":[[0,"parsedmarc.parse_forensic_report",false]],"parse_report_email() (in module parsedmarc)":[[0,"parsedmarc.parse_report_email",false]],"parse_report_file() (in module parsedmarc)":[[0,"parsedmarc.parse_report_file",false]],"parse_smtp_tls_report_json() (in module parsedmarc)":[[0,"parsedmarc.parse_smtp_tls_report_json",false]],"parsed_aggregate_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_aggregate_reports_to_csv",false]],"parsed_aggregate_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_aggregate_reports_to_csv_rows",false]],"parsed_failure_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_failure_reports_to_csv",false]],"parsed_failure_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_failure_reports_to_csv_rows",false]],"parsed_forensic_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_forensic_reports_to_csv",false]],"parsed_forensic_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_forensic_reports_to_csv_rows",false]],"parsed_smtp_tls_reports_to_csv() (in module parsedmarc)":[[0,"parsedmarc.parsed_smtp_tls_reports_to_csv",false]],"parsed_smtp_tls_reports_to_csv_rows() (in module parsedmarc)":[[0,"parsedmarc.parsed_smtp_tls_reports_to_csv_rows",false]],"parsedemail (class in parsedmarc.types)":[[0,"parsedmarc.types.ParsedEmail",false]],"parsedmarc":[[0,"module-parsedmarc",false]],"parsedmarc.elastic":[[0,"module-parsedmarc.elastic",false]],"parsedmarc.opensearch":[[0,"module-parsedmarc.opensearch",false]],"parsedmarc.splunk":[[0,"module-parsedmarc.splunk",false]],"parsedmarc.types":[[0,"module-parsedmarc.types",false]],"parsedmarc.utils":[[0,"module-parsedmarc.utils",false]],"parsererror":[[0,"parsedmarc.ParserError",false]],"parsingresults (class in parsedmarc.types)":[[0,"parsedmarc.types.ParsingResults",false]],"query_dns() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.query_dns",false]],"reversednsservice (class in parsedmarc.utils)":[[0,"parsedmarc.utils.ReverseDNSService",false]],"save_aggregate_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_aggregate_report_to_elasticsearch",false]],"save_aggregate_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_aggregate_report_to_opensearch",false]],"save_aggregate_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_aggregate_reports_to_splunk",false]],"save_failure_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_failure_report_to_elasticsearch",false]],"save_failure_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_failure_report_to_opensearch",false]],"save_failure_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_failure_reports_to_splunk",false]],"save_forensic_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_forensic_report_to_elasticsearch",false]],"save_forensic_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_forensic_report_to_opensearch",false]],"save_forensic_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_forensic_reports_to_splunk",false]],"save_output() (in module parsedmarc)":[[0,"parsedmarc.save_output",false]],"save_smtp_tls_report_to_elasticsearch() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.save_smtp_tls_report_to_elasticsearch",false]],"save_smtp_tls_report_to_opensearch() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.save_smtp_tls_report_to_opensearch",false]],"save_smtp_tls_reports_to_splunk() (parsedmarc.splunk.hecclient method)":[[0,"parsedmarc.splunk.HECClient.save_smtp_tls_reports_to_splunk",false]],"set_hosts() (in module parsedmarc.elastic)":[[0,"parsedmarc.elastic.set_hosts",false]],"set_hosts() (in module parsedmarc.opensearch)":[[0,"parsedmarc.opensearch.set_hosts",false]],"smtptlsfailuredetails (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSFailureDetails",false]],"smtptlsfailuredetailsoptional (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSFailureDetailsOptional",false]],"smtptlsparsedreport (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSParsedReport",false]],"smtptlspolicy (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSPolicy",false]],"smtptlspolicysummary (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSPolicySummary",false]],"smtptlsreport (class in parsedmarc.types)":[[0,"parsedmarc.types.SMTPTLSReport",false]],"splunkerror":[[0,"parsedmarc.splunk.SplunkError",false]],"timestamp_to_datetime() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.timestamp_to_datetime",false]],"timestamp_to_human() (in module parsedmarc.utils)":[[0,"parsedmarc.utils.timestamp_to_human",false]],"watch_inbox() (in module parsedmarc)":[[0,"parsedmarc.watch_inbox",false]]},"objects":{"":[[0,0,0,"-","parsedmarc"]],"parsedmarc":[[0,1,1,"","InvalidAggregateReport"],[0,1,1,"","InvalidDMARCReport"],[0,1,1,"","InvalidFailureReport"],[0,2,1,"","InvalidForensicReport"],[0,1,1,"","InvalidSMTPTLSReport"],[0,1,1,"","ParserError"],[0,3,1,"","append_json"],[0,0,0,"-","elastic"],[0,3,1,"","email_results"],[0,3,1,"","email_results_via_msgraph"],[0,3,1,"","extract_report"],[0,3,1,"","extract_report_from_file_path"],[0,3,1,"","get_dmarc_reports_from_mailbox"],[0,3,1,"","get_dmarc_reports_from_mbox"],[0,3,1,"","get_report_zip"],[0,0,0,"-","opensearch"],[0,3,1,"","parse_aggregate_report_file"],[0,3,1,"","parse_aggregate_report_xml"],[0,3,1,"","parse_failure_report"],[0,3,1,"","parse_forensic_report"],[0,3,1,"","parse_report_email"],[0,3,1,"","parse_report_file"],[0,3,1,"","parse_smtp_tls_report_json"],[0,3,1,"","parsed_aggregate_reports_to_csv"],[0,3,1,"","parsed_aggregate_reports_to_csv_rows"],[0,3,1,"","parsed_failure_reports_to_csv"],[0,3,1,"","parsed_failure_reports_to_csv_rows"],[0,3,1,"","parsed_forensic_reports_to_csv"],[0,3,1,"","parsed_forensic_reports_to_csv_rows"],[0,3,1,"","parsed_smtp_tls_reports_to_csv"],[0,3,1,"","parsed_smtp_tls_reports_to_csv_rows"],[0,3,1,"","save_output"],[0,0,0,"-","splunk"],[0,0,0,"-","types"],[0,0,0,"-","utils"],[0,3,1,"","watch_inbox"]],"parsedmarc.elastic":[[0,1,1,"","AlreadySaved"],[0,1,1,"","ElasticsearchError"],[0,3,1,"","create_indexes"],[0,3,1,"","migrate_indexes"],[0,3,1,"","save_aggregate_report_to_elasticsearch"],[0,3,1,"","save_failure_report_to_elasticsearch"],[0,3,1,"","save_forensic_report_to_elasticsearch"],[0,3,1,"","save_smtp_tls_report_to_elasticsearch"],[0,3,1,"","set_hosts"]],"parsedmarc.opensearch":[[0,1,1,"","AlreadySaved"],[0,1,1,"","OpenSearchError"],[0,3,1,"","create_indexes"],[0,3,1,"","migrate_indexes"],[0,3,1,"","save_aggregate_report_to_opensearch"],[0,3,1,"","save_failure_report_to_opensearch"],[0,3,1,"","save_forensic_report_to_opensearch"],[0,3,1,"","save_smtp_tls_report_to_opensearch"],[0,3,1,"","set_hosts"]],"parsedmarc.splunk":[[0,4,1,"","HECClient"],[0,1,1,"","SplunkError"]],"parsedmarc.splunk.HECClient":[[0,5,1,"","close"],[0,5,1,"","save_aggregate_reports_to_splunk"],[0,5,1,"","save_failure_reports_to_splunk"],[0,5,1,"","save_forensic_reports_to_splunk"],[0,5,1,"","save_smtp_tls_reports_to_splunk"]],"parsedmarc.types":[[0,4,1,"","AggregateAlignment"],[0,4,1,"","AggregateAuthResultDKIM"],[0,4,1,"","AggregateAuthResultSPF"],[0,4,1,"","AggregateAuthResults"],[0,4,1,"","AggregateIdentifiers"],[0,4,1,"","AggregateParsedReport"],[0,4,1,"","AggregatePolicyEvaluated"],[0,4,1,"","AggregatePolicyOverrideReason"],[0,4,1,"","AggregatePolicyPublished"],[0,4,1,"","AggregateRecord"],[0,4,1,"","AggregateReport"],[0,4,1,"","AggregateReportMetadata"],[0,4,1,"","EmailAddress"],[0,4,1,"","EmailAttachment"],[0,4,1,"","FailureParsedReport"],[0,4,1,"","FailureReport"],[0,2,1,"","ForensicParsedReport"],[0,2,1,"","ForensicReport"],[0,4,1,"","IPSourceInfo"],[0,4,1,"","ParsedEmail"],[0,4,1,"","ParsingResults"],[0,4,1,"","SMTPTLSFailureDetails"],[0,4,1,"","SMTPTLSFailureDetailsOptional"],[0,4,1,"","SMTPTLSParsedReport"],[0,4,1,"","SMTPTLSPolicy"],[0,4,1,"","SMTPTLSPolicySummary"],[0,4,1,"","SMTPTLSReport"]],"parsedmarc.utils":[[0,1,1,"","DownloadError"],[0,1,1,"","EmailParserError"],[0,4,1,"","IPAddressInfo"],[0,1,1,"","InvalidIPinfoAPIKey"],[0,4,1,"","ReverseDNSService"],[0,3,1,"","configure_ipinfo_api"],[0,3,1,"","convert_outlook_msg"],[0,3,1,"","decode_base64"],[0,3,1,"","get_base_domain"],[0,3,1,"","get_filename_safe_string"],[0,3,1,"","get_ip_address_country"],[0,3,1,"","get_ip_address_db_record"],[0,3,1,"","get_ip_address_info"],[0,3,1,"","get_reverse_dns"],[0,3,1,"","get_service_from_reverse_dns_base_domain"],[0,3,1,"","human_timestamp_to_datetime"],[0,3,1,"","human_timestamp_to_unix_timestamp"],[0,3,1,"","is_mbox"],[0,3,1,"","is_outlook_msg"],[0,3,1,"","load_ip_db"],[0,3,1,"","load_psl_overrides"],[0,3,1,"","load_reverse_dns_map"],[0,3,1,"","parse_email"],[0,3,1,"","query_dns"],[0,3,1,"","timestamp_to_datetime"],[0,3,1,"","timestamp_to_human"]]},"objnames":{"0":["py","module","Python module"],"1":["py","exception","Python exception"],"2":["py","attribute","Python attribute"],"3":["py","function","Python function"],"4":["py","class","Python class"],"5":["py","method","Python method"]},"objtypes":{"0":"py:module","1":"py:exception","2":"py:attribute","3":"py:function","4":"py:class","5":"py:method"},"terms":{"00z":10,"00z_exampl":10,"09t00":10,"09t23":10,"1d":12,"1g":4,"1w":12,"2017a":[3,8],"21vianet":12,"2d":12,"2k":12,"30s":12,"3d":10,"3h":12,"59z":10,"5m":[2,12],"7d":12,"A":[0,3,7,12],"AT":10,"After":[2,12],"All":[3,8,12],"An":[0,12],"And":0,"As":[4,7],"By":[7,12],"Do":[0,12],"Each":12,"For":[4,12],"From":[3,7,8,12],"Further":7,"Have":12,"Here":10,"IF":12,"If":[0,3,4,6,7,8,12],"In":[0,2,3,7,8,12],"It":[2,4,7,10,12],"More":6,"Most":[7,12],"NOT":12,"No":[3,6,8],"Not":12,"On":[3,4,6,7,8,12],"Or":[4,6,12],"Some":[2,3,7,8],"That":7,"The":[0,3,6,7,11,12],"Then":[2,3,4,6,8,12],"There":7,"These":[7,12],"This":[0,5,6,7,10,12],"To":[2,4,6,7,9,10,12],"Under":[4,7],"What":5,"When":[0,3,5,8,12],"Where":[3,8],"While":[7,12],"With":[7,12],"YOUR":4,"You":[2,7,12],"_":12,"_attempt":0,"_cluster":12,"_input":0,"_ipdatabaserecord":0,"_serverless_rejected_set":0,"aadst":12,"abl":6,"abort":12,"abov":[2,6,12],"accept":[0,3,4,7,8,12],"access":[0,4,5,12],"access_key_id":12,"access_token":0,"accessright":12,"accident":[3,8],"account":[6,7,12],"acm":10,"acquir":12,"acquisit":12,"across":7,"action":[3,8,12],"activ":[4,5,12],"active_primary_shard":12,"active_shard":12,"actual":[3,10],"ad":12,"add":[2,3,4,6,7,8,12],"addit":[3,8,12],"address":[0,2,3,4,6,7,8,10,12],"addresse":7,"adkim":10,"admin":[3,8,12],"administr":[3,8,12],"agari":5,"agent":4,"aggreg":[0,5,11,12],"aggregate_csv_filenam":[0,12],"aggregate_index":0,"aggregate_json_filenam":[0,12],"aggregate_report":0,"aggregate_top":12,"aggregate_url":12,"aggregatealign":0,"aggregateauthresult":0,"aggregateauthresultdkim":0,"aggregateauthresultspf":0,"aggregateidentifi":0,"aggregateparsedreport":0,"aggregatepolicyevalu":0,"aggregatepolicyoverridereason":0,"aggregatepolicypublish":0,"aggregaterecord":0,"aggregatereport":0,"aggregatereportmetadata":0,"aggress":12,"alia":[0,12],"alias":12,"align":[5,7,10],"aliv":0,"allow":[2,3,8,12],"allow_unencrypted_storag":12,"allowremot":2,"alon":12,"alreadi":[0,12],"alreadysav":0,"also":[0,2,3,4,6,7,8,12],"alter":[3,8],"altern":[5,12],"although":11,"alway":[0,2,4,12],"always_use_local_fil":[0,12],"amazon":5,"amd64":12,"amount":12,"analyt":[5,12],"analyz":12,"ani":[0,3,6,7,8,12],"anonym":10,"anoth":[6,12],"answer":[0,12],"apach":5,"api":[2,4,5,12],"api_key":[0,12],"app":12,"appear":12,"append":[0,12],"append_json":0,"appendix":10,"appid":12,"appli":[0,12],"applic":12,"applicationaccesspolici":12,"approach":12,"approxim":2,"apt":[2,4,6],"archiv":[0,12],"archive_fold":[0,12],"argument":12,"arm64":12,"around":12,"array":0,"arriv":12,"arrival_d":10,"arrival_date_utc":[0,10],"artifact":4,"as_domain":[0,10],"as_nam":[0,10],"ask":3,"asmx":2,"asn":[0,6,10,12],"aspf":10,"assert":12,"assign":4,"associ":0,"assum":12,"assume_utc":0,"astimezon":0,"att":10,"attach":[0,3,8,10,12],"attachment_filenam":0,"attempt":[0,12],"attribut":6,"auth":[0,2,10,12],"auth_failur":10,"auth_method":12,"auth_mod":12,"auth_result":10,"auth_typ":[0,12],"authent":[0,2,3,4,7,12],"authentication_mechan":10,"authentication_result":10,"authentication_typ":12,"auto":2,"automat":[6,12],"avail":[6,12],"avoid":[7,12],"aw":[0,12],"aws_region":[0,12],"aws_servic":[0,12],"awssigv4":[0,12],"az":12,"azur":[5,12],"b":10,"b2c":7,"back":[0,12],"backend":[0,12],"backfil":12,"backlog":12,"backward":12,"bare":12,"base":[0,2,3,4,6,7,8,10,12],"base64":0,"base_domain":[0,10],"basic":[0,2,12],"batch":12,"batch_siz":[0,12],"bcc":[0,10],"bd6e1bb5":10,"becaus":[2,3,7,8,12],"becom":12,"befor":[0,12],"begin_d":10,"behavior":0,"behind":6,"benefit":5,"best":[7,12],"beyond":0,"bin":[2,4,6,12],"binari":[0,12],"binaryio":0,"bind":2,"bindaddress":2,"blank":[3,8],"block":[2,12],"bodi":[0,3,8,10,12],"bool":[0,12],"boundari":[0,12],"box":12,"brand":[5,7],"break":[3,4,8],"broken":0,"browser":4,"bucket":12,"budget":0,"bug":[5,12],"build":6,"built":0,"bundl":[0,6,7,12],"busi":7,"button":[3,8],"byte":0,"c":[10,12],"ca":[4,12],"cach":[0,12],"cafile_path":12,"call":[0,5,12],"callabl":0,"callback":0,"came":[3,8],"can":[0,2,3,4,5,6,7,8,12],"cap":[0,12],"carri":[0,6,12],"case":[2,3,8,12],"catch":[0,12],"caught":0,"caus":[3,4,7,8,12],"cc":[0,10],"center":7,"cento":[4,6],"cert":[4,12],"cert_path":12,"certain":[0,12],"certfile_path":12,"certif":[0,4,7,12],"certificate_password":12,"certificate_path":12,"cest":10,"chain":0,"chang":[4,7,11,12],"charact":[2,12],"charset":10,"chart":7,"check":[0,2,3,4,7,12],"check_timeout":[0,12],"checkbox":4,"checkdmarc":3,"china":12,"chinacloudapi":12,"chines":7,"chmod":[2,4,12],"choos":[3,8],"chown":[2,12],"ci":7,"cisco":12,"class":0,"clean":[0,12],"clear":0,"cli":[0,5],"click":[4,7],"client":[0,2,3,4,8,12],"client_assert":12,"client_id":12,"client_secret":12,"clientassert":12,"clientsecret":12,"clientsotimeout":2,"clock":0,"close":[0,12],"cloud":[0,12],"cloudflar":[0,12],"cluster":[4,12],"cn":12,"co":4,"code":[0,4,12],"collect":[7,12],"collector":[11,12],"com":[1,2,3,8,9,10,12],"combin":12,"come":[0,7],"comfort":12,"comma":[6,12],"command":[2,3,6,8,12],"comment":12,"commerci":[4,5],"common":[3,4,6,8],"communiti":[3,8],"compat":[0,7,12],"complet":[3,4,12],"compli":[3,4,6,8,9],"compliant":[3,8],"compon":6,"compress":5,"conf":6,"config":[0,2,6],"config_fil":12,"config_reload":0,"configur":[0,3,4,5,6,7,8,9],"configure_ipinfo_api":0,"confirm":12,"conform":4,"connect":[0,2,4,12],"connection_str":12,"consent":12,"consid":[5,7],"consist":[0,5,10],"consol":[4,12],"constant":0,"consult":6,"consum":[7,12],"contact":[7,12],"contain":[0,7,11,12],"content":[0,3,8,10,11,12],"contrib":6,"contribut":5,"control":[0,4,12],"convent":12,"convert":[0,3,8],"convert_outlook_msg":0,"copi":[0,6,11,12],"core":[3,8],"correct":[0,6,7,12],"correspond":12,"corrupt":0,"count":[2,7,10],"countri":[0,7,10,12],"country_cod":0,"cpan":6,"cr":12,"crash":[2,4,12],"creat":[0,2,3,4,6,8,12],"create_fold":0,"create_index":0,"creation":12,"creativ":6,"credenti":[6,12],"credentials_fil":12,"cron":6,"cross":0,"crt":4,"csr":4,"csv":[0,5,12],"ctrl":12,"cumul":6,"current":[0,2,4,12],"custom":[7,12],"d":[0,4,12],"daemon":[2,4,12],"daili":[0,12],"dashboard":[4,5,9,11],"dat":0,"data":[0,4,5,6,7,9,11,12],"databas":[0,12],"date":[0,3,8,10],"date_utc":10,"datetim":0,"davmail":5,"day":[0,4,9,12],"db_path":0,"dbip":[0,6,12],"dbname":12,"dce":12,"dcr":12,"dcr_aggregate_stream":12,"dcr_failure_stream":12,"dcr_immutable_id":12,"dcr_smtp_tls_stream":12,"dd":[0,12],"de":10,"dearmor":4,"deb":4,"debian":[4,5,6],"debug":12,"decemb":6,"decod":0,"decode_base64":0,"dedic":6,"default":[0,2,4,5,6,7,12],"defens":5,"delay":[2,10,12],"deleg":12,"delegated_us":12,"delet":[0,2,4,12],"deliber":12,"delivery_result":10,"demystifi":3,"deni":12,"depend":[0,4,5,12],"deploy":[3,8,12],"deprec":12,"describ":12,"descript":[2,6,12],"design":12,"destin":[0,12],"detail":[6,7,12],"dev":[6,12],"devel":6,"develop":5,"devicecod":12,"dict":0,"dictionari":0,"differ":[7,12],"difficult":12,"dig":0,"digest":[3,8],"dir":6,"direct":[7,12],"directori":[0,6,12],"dis":10,"disabl":[0,2,6,12],"disclaim":[3,8],"disk":[0,12],"display":[3,7,11],"display_nam":10,"disposit":[7,10],"distinguish":12,"distribut":6,"distro":6,"dkim":[5,7,8,10],"dkim_align":10,"dkim_domain":10,"dkim_result":10,"dkim_selector":10,"dkm":3,"dmarc":[0,4,6,8,9,10,11,12],"dmarc_aggreg":4,"dmarc_align":10,"dmarc_failur":4,"dmarc_moderation_act":[3,8],"dmarc_none_moderation_act":[3,8],"dmarc_quarantine_moderation_act":[3,8],"dmarcian":5,"dmarcresport":12,"dnf":6,"dns":[0,3,6,7,12],"dns_retri":0,"dns_test_address":12,"dns_timeout":[0,12],"dnspython":0,"doc":[0,9,12],"doctyp":10,"document":[0,2,12],"dod":12,"doe":[3,8,12],"doesn":0,"domain":[0,4,7,8,10,12],"domainawar":[1,3,12],"don":3,"doubl":12,"download":[0,2,4,6,12],"downloaderror":0,"draft":[5,10,12],"dsn":12,"dtd":10,"dummi":12,"dure":[2,12],"e":[0,2,3,4,6,8,12],"e7":10,"earlier":[0,7],"easi":[4,9],"easier":[11,12],"echo":4,"edit":[2,6,12],"editor":11,"effect":12,"effici":4,"either":[5,12],"elast":[4,5,12],"elasticsearch":[0,5,12],"elasticsearcherror":0,"elig":12,"elk":12,"els":4,"email":[0,3,5,6,7,8,10,11,12],"email_result":0,"email_results_via_msgraph":0,"emailaddress":0,"emailattach":0,"emailparsererror":0,"empti":[0,3,8,12],"en":[3,4,8,10],"enabl":[2,4,12],"enableew":2,"enablekeepal":2,"enableproxi":2,"encod":[0,10,12],"encount":0,"encrypt":[4,12],"encryptedsavedobject":4,"encryptionkey":4,"end":[0,3,4,5,12],"end_dat":10,"endpoint":[5,12],"endpoint_url":12,"enforc":[3,8],"enough":12,"enrich":6,"enrol":4,"ensur":[3,6,8],"enterpris":12,"entir":[0,3,7,8,12],"entra":12,"entri":0,"envelop":3,"envelope_from":10,"envelope_to":10,"environ":[5,6],"eof":0,"eol":5,"epel":6,"era":0,"error":[0,7,10,12],"erroritemnotfound":12,"es":[0,12],"escap":12,"especi":[7,12],"etc":[2,3,4,6,8,12],"even":[2,3,8,12],"event":[2,11,12],"ever":0,"everi":[0,2,6,7,12],"ew":5,"ex":12,"exact":[3,8],"exampl":[3,4,6,8,10],"except":[0,12],"exchang":[2,10,12],"exclud":2,"exclus":0,"execreload":12,"execstart":[2,12],"exhaust":12,"exist":[0,3,4,8,12],"exit":[0,12],"expect":12,"expiri":7,"expiringdict":0,"explain":[3,8],"explicit":[0,3,6,8,12],"export":[4,7,12],"extra":12,"extract":[0,2],"extract_report":0,"extract_report_from_file_path":0,"eye":[2,12],"f":4,"factor":2,"fail":[0,3,7,8,10,12],"fail_on_output_error":12,"failed_session_count":10,"failov":0,"failur":[0,5,11,12],"failure_csv_filenam":[0,12],"failure_detail":10,"failure_index":0,"failure_json_filenam":[0,12],"failure_report":0,"failure_top":12,"failure_url":12,"failureparsedreport":0,"failurereport":0,"fall":[0,12],"fallback":[0,12],"fals":[0,2,10,12],"fantast":[3,8],"faster":12,"fatal":[0,12],"featur":[4,12],"feedback":0,"feedback_report":0,"feedback_typ":10,"fetch":[0,7,12],"field":[0,4],"file":[0,2,5,6,7,11],"file_path":[0,12],"filenam":[0,12],"filename_safe_subject":10,"filepath":12,"fill":[4,6],"filter":[0,3,7,8,11,12],"final":5,"financ":12,"find":[3,7,8,12],"fine":[3,8],"finish":12,"first":[0,3,6,8,12],"first_strip_reply_to":[3,8],"fit":[3,8,12],"fix":[4,12],"flag":[0,2,6,12],"flat":0,"flexibl":11,"flight":12,"float":[0,12],"flush":12,"fo":[0,10],"fold":0,"folder":[0,2,12],"foldersizelimit":2,"follow":[2,4,5,12],"footer":[3,8],"forc":12,"foreground":12,"forens":[5,7,12],"forensicparsedreport":0,"forensicreport":0,"form":12,"format":[0,7,12],"former":[5,7,12],"forward":[3,7,8],"found":[0,6,12],"foundat":10,"fqdn":4,"fraud":5,"free":[6,12],"fresh":12,"freshest":12,"friend":7,"from_is_list":[3,8],"ftp_proxi":6,"full":12,"fulli":[3,8,12],"function":0,"g":[0,2,3,4,6,8,12],"gateway":2,"gb":4,"gcc":[6,12],"gdpr":[4,9],"gelf":[5,12],"general":[3,6,8,12],"generat":[3,4,8,10],"geoip":[6,12],"geoipupd":6,"geolite2":5,"geoloc":[0,12],"get":[0,2,4,6,12],"get_base_domain":0,"get_dmarc_reports_from_mailbox":0,"get_dmarc_reports_from_mbox":0,"get_filename_safe_str":0,"get_ip_address_countri":0,"get_ip_address_db_record":0,"get_ip_address_info":0,"get_report_zip":0,"get_reverse_dn":0,"get_service_from_reverse_dns_base_domain":0,"ghcr":12,"github":[1,6,10,12],"give":[0,4],"given":[0,12],"glass":7,"global":12,"gmail":[5,7,12],"gmail_api":12,"go":[0,3,8],"goe":[3,8],"googl":[7,12],"googleapi":12,"got":12,"gov":12,"govern":12,"gpg":4,"grafana":5,"grant":12,"graph":[0,2,5,7,12],"graph_url":12,"graylog":5,"group":[2,7,12],"guid":[4,5],"guidanc":12,"gzip":[0,5],"h":[0,12],"hamburg":4,"hand":[3,8],"handl":[5,12],"handler":7,"happen":0,"hard":12,"has_defect":10,"hasn":12,"head":10,"header":[0,3,7,8,10,12],"header_from":10,"headless":2,"health":12,"healthcar":12,"heap":4,"heavi":[4,12],"hec":[0,11,12],"hecclient":0,"hectokengoesher":12,"help":5,"hh":0,"hierarchi":12,"high":[7,12],"higher":[3,8],"histor":12,"histori":12,"hit":[0,12],"home":6,"hop":10,"host":[0,2,3,4,5,8,12],"hostnam":[0,12],"hour":[0,12],"hover":7,"href":10,"html":[3,4,8,10],"http":[0,2,4,5,6,10,11,12],"http_proxi":6,"https":[0,1,2,3,4,6,8,9,12],"https_proxi":6,"httpx":12,"human":[0,7],"human_timestamp":0,"human_timestamp_to_datetim":0,"human_timestamp_to_unix_timestamp":0,"hup":12,"icon":7,"id":[3,8,10,12],"ideal":[3,8],"ident":[3,8,12],"identifi":10,"idl":[0,2,12],"ignor":[0,12],"imag":12,"imap":[0,2,5,12],"imap_password":12,"imapalwaysapproxmsgs":2,"imapautoexpung":2,"imapcli":5,"imapidledelay":2,"imapport":2,"immedi":[2,12],"immut":12,"impli":12,"import":[4,7,12],"improv":12,"inbox":[0,3,5,8,12],"inc":10,"includ":[0,3,6,8,12],"include_list_post_head":[3,8],"include_rfc2369_head":[3,8],"include_sender_head":[3,8],"include_spam_trash":12,"incom":[7,12],"incorrect":12,"increas":[4,12],"increment":12,"indefinit":12,"indent":12,"index":[0,5,9,11,12],"index_prefix":[0,12],"index_prefix_domain_map":12,"index_suffix":[0,12],"indic":[3,5],"individu":12,"industri":12,"inform":[0,4,7,12],"infrequ":12,"ingest":12,"ini":[2,12],"initi":0,"inner":12,"input":0,"input_":0,"inspect":12,"instal":[2,5,12],"installed_app":12,"instanc":12,"instead":[0,3,4,6,8,12],"int":[0,12],"intend":[3,8],"interact":[2,4,12],"interakt":10,"interfer":[3,8],"interpret":[0,6],"interrupt":12,"interval":12,"interval_begin":10,"interval_end":10,"invalid":[0,12],"invalidaggregatereport":0,"invaliddmarcreport":0,"invalidfailurereport":0,"invalidforensicreport":0,"invalidipinfoapikey":0,"invalidsmtptlsreport":0,"involv":7,"io":[0,12],"ip":[0,3,4,7,12],"ip_address":[0,10],"ip_db_path":[0,6,12],"ip_db_url":12,"ipaddressinfo":0,"ipinfo":[0,6,12],"ipinfo_api_token":12,"ipinfo_url":12,"ipsourceinfo":0,"ipv4":0,"ipv6":0,"is_mbox":0,"is_outlook_msg":0,"iso":[0,12],"issu":1,"item":[0,12],"java":2,"job":[3,6,8],"joe":[3,8],"journalctl":[2,12],"jre":2,"json":[0,5,12],"june":5,"junk":12,"just":7,"jvm":4,"jwt":12,"kafka":[5,12],"kb4099855":6,"kb4134118":6,"kb4295699":6,"keep":[0,12],"keep_al":0,"keepal":2,"kept":0,"key":[0,3,4,6,12],"keyfile_path":12,"keyout":4,"keyr":4,"keystor":4,"kibana":[5,11],"kill":12,"killsign":12,"kind":12,"know":3,"known":[0,3,7,8,12],"kubernet":12,"kwarg":0,"l4":12,"l5":12,"label":12,"languag":[3,8],"larg":[2,12],"larger":12,"last":6,"later":[0,4,6,12],"latest":[2,4,9,12],"layer":0,"layout":11,"leak":7,"least":[4,6,12],"leav":3,"left":[0,7],"legaci":[0,5],"legal":[3,8],"legitim":[7,12],"less":12,"level":[0,3,4,12],"lf":12,"libemail":6,"libpq":12,"librari":12,"libxml2":6,"libxslt":6,"licens":6,"life":5,"lifetim":0,"lifetimetimeout":0,"like":[0,3,6,8,12],"limit":[0,2,12],"line":[3,8,12],"link":[3,4,7,8],"linux":[3,6,8],"list":[0,2,4,5,7,12],"listen":[2,12],"lite":[0,6,12],"live":[7,12],"ll":[3,8],"load":[0,4,12],"load_ip_db":0,"load_psl_overrid":0,"load_reverse_dns_map":0,"local":[0,2,4,6,10,12],"local_file_path":0,"local_psl_overrides_path":12,"local_reverse_dns_map_path":12,"localhost":12,"locat":[7,12],"log":[0,2,5,12],"log_analyt":12,"log_fil":12,"logger":12,"login":[4,12],"logstash":4,"long":[0,3,12],"longer":[3,6,8],"look":[0,3,7],"lookup":[0,12],"loop":[0,12],"loopback":2,"loss":0,"lot":7,"low":12,"lower":12,"lua":10,"m":[0,6,12],"m365":12,"maco":6,"magnifi":7,"mail":[0,5,6,10,12],"mail_bcc":0,"mail_cc":0,"mail_from":0,"mail_to":0,"mailbox":[0,7,12],"mailbox_check_timeout":12,"mailbox_connect":0,"mailboxconnect":0,"maildir":12,"maildir_cr":12,"maildir_path":12,"mailer":10,"mailrelay":10,"mailsuit":12,"mailto":6,"main":4,"mainpid":12,"maintain":5,"make":[0,3,4,6,8,9,12],"malici":[7,12],"manag":[4,7,12],"mandatori":12,"manual":12,"map":0,"mariadb":12,"market":7,"massiv":12,"match":[0,4,11,12],"max_ag":10,"max_shards_per_nod":12,"maximum":4,"maxmind":[0,5,12],"may":[5,7,12],"mbox":[0,12],"mean":12,"mechan":3,"member":[3,8],"memori":12,"mention":7,"menu":[4,7],"merg":0,"messag":[0,2,3,4,6,7,8,10,12],"message_id":10,"meta":10,"method":12,"mfrom":10,"microsoft":[0,2,5,10,12],"microsoftgraph":12,"microsoftonlin":12,"mid":12,"might":[0,3,7,8],"migrat":[0,7,12],"migrate_index":0,"mime":10,"min":0,"minim":12,"minimum":[4,12],"minut":[0,2,12],"mirror":0,"miss":[6,12],"mitig":[3,8],"mix":0,"mm":[0,12],"mmdb":[0,6,12],"mobil":[3,8],"mode":[0,2,4,6,10],"modern":[2,3,8],"modifi":[0,3,8,12],"modul":[0,5,6,12],"mon":10,"monitor":[3,12],"month":[0,12],"monthly_index":[0,12],"mous":7,"move":[0,4,12],"ms":[0,10,12],"msal":12,"msg":[0,6],"msg_byte":0,"msg_date":0,"msg_footer":[3,8],"msg_header":[3,8],"msgconvert":[0,6],"msgraph":12,"msgraphconnect":0,"mta":7,"much":12,"multi":[2,5],"multipl":[0,12],"mung":[3,8],"must":[2,3,4,8,12],"mutual":[4,12],"mv":4,"mx":10,"n":[0,10,12],"n_proc":12,"naiv":0,"name":[0,3,4,7,10,11],"nameserv":[0,12],"nano":[2,12],"nation":12,"navig":[3,8],"ncontent":10,"ndate":10,"ndjson":[4,7],"need":[0,2,3,4,6,7,8,12],"neither":12,"nelson":[3,8],"net":[2,12],"network":[0,2,4,12],"never":12,"new":[0,2,5,6,7,12],"newer":6,"newest":[2,12],"newkey":4,"news":3,"next":[0,12],"nfrom":10,"nmessag":10,"nmime":10,"node":4,"nologin":6,"non":[0,3,4,8,12],"nonameserv":0,"none":[0,3,10,12],"noproxyfor":2,"norepli":[3,10],"normal":[0,10,12],"normalize_timespan_threshold_hour":0,"normalized_timespan":10,"nosecureimap":2,"notabl":7,"note":12,"noth":12,"notic":12,"now":[4,6,7],"nsubject":10,"nto":10,"null":[6,10],"number":[0,12],"number_of_replica":[0,12],"number_of_shard":[0,12],"nwettbewerb":10,"nx":10,"o":[2,4,12],"oR":6,"oauth2":12,"oauth2_port":12,"object":[0,4,7],"observ":[7,12],"occur":[0,7],"occurr":11,"oct":10,"offic":2,"office365":2,"offici":12,"offlin":[0,6,12],"offset":[0,12],"often":[7,12],"old":7,"older":[6,10,12],"oldest":[2,12],"ole":[0,6],"omit":12,"onc":12,"ondmarc":5,"one":[0,3,5,6,8,12],"onli":[0,2,3,6,7,8],"onlin":[0,2,12],"onto":0,"oor":0,"op":0,"open":[0,3],"opendn":12,"opensearch":[4,5,7,12],"opensearch_dashboard":7,"opensearcherror":0,"openssl":4,"oper":12,"opt":[2,6,12],"option":[0,2,3,4,5,8,11,12],"order":12,"org":[0,6,9,10,12],"org_email":10,"org_extra_contact_info":10,"org_nam":10,"organiz":[2,5,7,12],"organization_nam":10,"origin":[3,8,12],"original_envelope_id":10,"original_mail_from":10,"original_rcpt_to":10,"original_timespan_second":10,"os":0,"oserror":0,"otherwis":[0,12],"outdat":7,"outgo":[3,8,12],"outlook":[0,2,6,12],"output":[0,5,12],"output_directori":0,"outsid":12,"overal":0,"overrid":[0,6,12],"overwrit":[0,4],"owa":[5,12],"owned":6,"ownership":6,"p":[3,10],"p12":4,"pack":4,"packag":[0,4,6],"packet":0,"pad":0,"page":[3,4,6,7,8],"paginate_messag":12,"pan":10,"parallel":12,"paramet":[0,12],"parent":7,"pars":[0,3,5,6,10,12],"parse_aggregate_report_fil":0,"parse_aggregate_report_xml":0,"parse_email":0,"parse_failure_report":0,"parse_forensic_report":0,"parse_report_email":0,"parse_report_fil":0,"parse_smtp_tls_report_json":0,"parsed_aggregate_reports_to_csv":0,"parsed_aggregate_reports_to_csv_row":0,"parsed_failure_reports_to_csv":0,"parsed_failure_reports_to_csv_row":0,"parsed_forensic_reports_to_csv":0,"parsed_forensic_reports_to_csv_row":0,"parsed_sampl":10,"parsed_smtp_tls_reports_to_csv":0,"parsed_smtp_tls_reports_to_csv_row":0,"parsedemail":0,"parsedmarc":[4,9,10,11],"parsedmarc_":12,"parsedmarc_config_fil":12,"parsedmarc_debug":12,"parsedmarc_elasticsearch_":12,"parsedmarc_elasticsearch_host":12,"parsedmarc_elasticsearch_ssl":12,"parsedmarc_gelf_":12,"parsedmarc_general_":12,"parsedmarc_general_debug":12,"parsedmarc_general_ipinfo_api_token":12,"parsedmarc_general_ipinfo_url":12,"parsedmarc_general_offlin":12,"parsedmarc_general_save_aggreg":12,"parsedmarc_general_save_failur":12,"parsedmarc_gmail_api_":12,"parsedmarc_gmail_api_credentials_file_fil":12,"parsedmarc_imap_":12,"parsedmarc_imap_host":12,"parsedmarc_imap_password":12,"parsedmarc_imap_password_fil":12,"parsedmarc_imap_us":12,"parsedmarc_kafka_":12,"parsedmarc_log_analytics_":12,"parsedmarc_mailbox_":12,"parsedmarc_mailbox_watch":12,"parsedmarc_maildir_":12,"parsedmarc_msgraph_":12,"parsedmarc_opensearch_":12,"parsedmarc_s3_":12,"parsedmarc_smtp_":12,"parsedmarc_splunk_hec_":12,"parsedmarc_splunk_hec_index":12,"parsedmarc_splunk_hec_token":12,"parsedmarc_splunk_hec_url":12,"parsedmarc_syslog_":12,"parsedmarc_webhook_":12,"parser":0,"parsererror":0,"parsingresult":0,"part":[3,4,7,8,12],"particular":[7,12],"pass":[0,3,7,10,12],"passag":7,"passsword":12,"password":[0,4,6,12],"paste":[4,11],"patch":6,"path":[0,4,6,12],"pathlik":0,"pattern":[0,5,7],"payload":[0,12],"pct":10,"peak":12,"pem":12,"per":[0,7,12],"percentag":7,"perform":[0,2,5],"period":12,"perl":[0,6],"permiss":[4,12],"persist":12,"peter":10,"pick":[6,12],"pickup":6,"pid":12,"pie":7,"pin":12,"pip":[6,12],"pkcs12":12,"place":[0,4,7,12],"plain":[0,12],"plaintext":[3,8],"platform":[3,6,8,12],"pleas":[1,5,12],"plug":12,"plus":[7,12],"point":[6,12],"polici":[3,7,8,10,12],"policy_domain":10,"policy_evalu":10,"policy_override_com":10,"policy_override_reason":10,"policy_publish":10,"policy_str":10,"policy_typ":10,"policyscopegroupid":12,"poll":[0,2,12],"popul":0,"port":[0,2,12],"portal":12,"posit":[0,12],"posix":0,"possibl":12,"post":[3,8,12],"poster":[3,8],"postgr":12,"postgresql":[5,12],"postorius":[3,8],"powershel":12,"ppa":6,"practic":12,"pre":[6,12],"prebuilt":12,"predict":12,"prefer":[2,6,12],"prefix":[0,3,8,12],"premad":[5,11],"prepend":0,"prerequisit":5,"present":12,"pressur":12,"pretti":12,"prettifi":12,"previous":[0,2,4,6,12],"pri":[2,12],"primari":0,"print":12,"printabl":10,"prioriti":12,"privaci":[3,6,7,8,12],"privat":12,"probe":0,"problem":12,"proc":12,"process":[0,2,5,6,12],"produc":[0,10],"program":12,"programdata":6,"progress":12,"project":[0,2,3,5,11,12],"prompt":4,"proofpoint":5,"properti":2,"protect":[2,3,5,8,12],"protocol":12,"provid":[0,4,7,12],"provis":12,"prox":6,"proxi":2,"proxyhost":2,"proxypassword":2,"proxyport":2,"proxyus":2,"psl":[0,12],"psl_overrid":0,"psl_overrides_path":0,"psl_overrides_url":[0,12],"psycopg":12,"public":[0,3,10,12],"public_suffix_list":0,"publicbaseurl":4,"publicsuffix":0,"publish":[3,12],"published_polici":0,"pull":12,"put":[4,12],"py":0,"python":[0,4,6],"python3":6,"qo":4,"quarantin":[3,8],"queri":[0,12],"query_dn":0,"quick":0,"quickstart":12,"quit":12,"quot":[10,12],"quota":[0,12],"r":[2,10,12],"rais":[0,12],"ram":[4,12],"rate":[0,12],"rather":[3,8,12],"raw":12,"re":[0,6,12],"reach":[0,12],"reachabl":12,"read":[0,12],"readabl":[0,12],"readwrit":12,"realli":3,"reason":[0,2,4,5,12],"receiv":[0,7,10,12],"receiveddatetim":12,"receiving_ip":10,"receiving_mx_hostnam":10,"recent":0,"recipi":7,"recogn":7,"recommend":12,"recommended_dns_nameserv":0,"record":[0,5,6,10,12],"record_typ":0,"redact":12,"redi":12,"reduc":[6,12],"refer":[4,5],"referenc":12,"refresh":[6,12],"refresh_interv":12,"refus":4,"regard":12,"regardless":[0,10,12],"region":[0,12],"region_nam":12,"regist":[6,12],"registr":12,"regul":[4,6,9,12],"regular":[3,8],"reject":[0,3,8,12],"relat":[3,12],"relay":[3,8],"releas":[4,6],"reli":[6,7],"reliabl":12,"reload":[0,2,4],"remain":[0,7,12],"remot":2,"remov":[0,3,4,8,12],"repeat":[0,3,8],"replac":[0,3,4,8,12],"repli":[2,3,8],"replic":12,"replica":[0,12],"reply_goes_to_list":[3,8],"reply_to":10,"replyto":[3,8],"repopul":0,"report":[0,4,11,12],"report_id":10,"report_metadata":10,"report_typ":0,"reported_domain":10,"reports_fold":[0,12],"repositori":[6,11],"req":4,"request":[0,2,4,12],"requir":[0,2,3,4,5,6,8,12],"require_encrypt":0,"reserv":12,"resid":12,"resolv":[0,12],"resort":6,"resourc":[0,4,5,12],"respons":[0,12],"rest":[0,12],"restart":[2,3,4,6,8],"restartsec":[2,12],"restor":4,"restrict":12,"restrictaccess":12,"result":[0,5,7,10,12],"result_typ":10,"resum":12,"retain":[3,8,12],"retent":5,"retri":[0,12],"retriev":2,"retry_attempt":12,"retry_delay":12,"return":0,"revers":[0,6,7,12],"reverse_dn":[0,10],"reverse_dns_base_domain":0,"reverse_dns_map":0,"reverse_dns_map_path":0,"reverse_dns_map_url":[0,12],"reversednsservic":0,"review":7,"rewrit":[0,3,8],"rfc":[0,3,5,8,10],"rfc2369":[3,8],"rfc822":2,"rhel":[4,5,6],"right":[4,7],"rm":4,"ro":0,"rocki":6,"rollup":6,"root":[2,12],"rough":12,"rpm":4,"rpt":[5,7],"rsa":4,"rua":[5,6],"ruf":[5,6,7,12],"rule":[7,12],"run":[0,4,5,6],"runtimeerror":12,"rw":[2,12],"s":[0,2,3,4,6,7,8,10,12],"s3":[5,12],"safe":0,"safer":12,"sampl":[0,5,7,12],"sample_headers_on":10,"save":[0,4,6,7,12],"save_aggreg":12,"save_aggregate_report_to_elasticsearch":0,"save_aggregate_report_to_opensearch":0,"save_aggregate_reports_to_splunk":0,"save_failur":12,"save_failure_report_to_elasticsearch":0,"save_failure_report_to_opensearch":0,"save_failure_reports_to_splunk":0,"save_forens":12,"save_forensic_report_to_elasticsearch":0,"save_forensic_report_to_opensearch":0,"save_forensic_reports_to_splunk":0,"save_output":0,"save_smtp_tl":12,"save_smtp_tls_report_to_elasticsearch":0,"save_smtp_tls_report_to_opensearch":0,"save_smtp_tls_reports_to_splunk":0,"sbin":6,"schedul":[6,12],"schema":[5,10,12],"scheme":0,"scope":[10,12],"script":6,"scrub_nondigest":[3,8],"sdk":12,"search":[0,3,8,12],"second":[0,2,12],"secret_access_key":12,"section":4,"secur":[0,4,12],"see":[2,3,4,6,7,12],"seek":0,"segment":7,"select":0,"selector":10,"self":[4,5],"send":[0,2,3,4,5,7,8,11,12],"sender":[5,7,8],"sending_mta_ip":10,"sendmail":[0,12],"sensit":12,"sent":[0,3,8,12],"sentinel":5,"separ":[0,3,4,6,7,9,11,12],"sequenc":0,"serial":12,"server":[0,2,3,4,5,6,7,10,12],"server_ip":4,"serverless":[0,12],"servernameon":10,"servic":[0,3,4,5,6,7,8,10],"service_account":12,"service_account_us":12,"session":[0,7],"set":[0,2,3,4,6,7,8,9,12],"set_host":0,"setup":[4,6,9,12],"shard":[0,12],"share":[4,6,12],"sharealik":6,"sharepoint":10,"shell":6,"ship":[6,12],"short":12,"shot":12,"shouldn":[3,8],"show":[2,7,12],"shown":[6,12],"shutdown":[0,12],"side":[7,12],"sighup":[0,6,12],"sigkil":12,"sign":[0,3,4,6,12],"signal":12,"signatur":[3,7,8],"sigterm":[0,12],"sigv4":[0,12],"silent":[6,12],"similar":7,"simpl":5,"simplifi":0,"sinc":[0,6,12],"singl":[0,12],"sink":12,"sister":3,"six":12,"size":[2,4],"skel":6,"skip":[0,12],"skip_certificate_verif":[0,12],"slight":11,"slow":0,"small":[4,12],"smaller":12,"smtp":[0,3,5,12],"smtp_tls":[0,12],"smtp_tls_csv_filenam":[0,12],"smtp_tls_json_filenam":[0,12],"smtp_tls_report":0,"smtp_tls_url":12,"smtptlsfailuredetail":0,"smtptlsfailuredetailsopt":0,"smtptlsparsedreport":0,"smtptlspolici":0,"smtptlspolicysummari":0,"smtptlsreport":0,"socket":2,"solut":6,"somehow":12,"someon":4,"sometim":12,"sort":[7,12],"sourc":[0,3,4,6,7,10],"source_as_domain":10,"source_as_nam":10,"source_asn":10,"source_base_domain":10,"source_countri":10,"source_ip_address":10,"source_nam":10,"source_reverse_dn":10,"source_typ":10,"sourceforg":2,"sovereign":12,"sp":[3,10],"spam":12,"special":12,"specif":[3,6,7,12],"specifi":[2,3],"spf":[7,10],"spf_align":10,"spf_domain":10,"spf_result":10,"spf_scope":10,"splunk":[5,12],"splunk_hec":12,"splunkerror":0,"splunkhec":12,"sponsor":5,"spoof":[3,8],"spurious":12,"ss":0,"ssl":[0,2,4,12],"ssl_cert_path":0,"stabl":4,"stack":[4,7,12],"standard":[0,5,6,10],"start":[0,2,4,7,9,11,12],"starttl":[7,12],"startup":[0,6],"static":12,"status":[2,12],"stay":7,"stdout":12,"step":[3,4,6,8,12],"still":[0,3,8,10,12],"stop":12,"storag":[0,12],"store":[2,4,9,12],"str":[0,12],"straight":12,"stream":12,"string":[0,12],"strip":[0,3,8,12],"strip_attachment_payload":[0,12],"strong":12,"structur":5,"sts":[7,10,12],"stsv1":10,"style":0,"subdomain":[0,3,12],"subject":[0,3,8,10,12],"subject_prefix":[3,8],"subsidiari":7,"substitut":6,"success":12,"successful_session_count":10,"sudo":[2,4,6,12],"suffici":12,"suffix":0,"suggest":7,"suit":12,"suitabl":0,"summari":[3,8,12],"supervis":12,"suppli":[0,7,12],"support":[2,4,5,7,10,11],"sure":4,"surfac":[7,12],"sw50zxjha3rpdmugv2v0dgjld2vyymvylcocymvyc2ljahq":10,"switch":7,"syslog":[2,5,12],"system":[2,3,4,6,8,12],"systemctl":[2,4,12],"systemd":5,"systemdr":6,"t":[0,5,8,10,12],"tab":[3,4,8],"tabl":[5,7,12],"tag":6,"take":[0,12],"target":[0,2,12],"task":6,"tbi":10,"tcp":12,"tee":4,"tell":[3,7,8],"templat":[3,8],"temporari":7,"tenant":5,"tenant_id":12,"term":6,"test":[0,10,12],"text":[0,10],"thank":10,"therebi":[3,8],"therefor":0,"thousand":12,"three":7,"throughput":12,"tier":12,"time":[0,2,4,6,7,12],"timeout":[0,2,12],"timeoutstopsec":12,"timespan":0,"timespan_requires_norm":10,"timestamp":[0,12],"timestamp_to_datetim":0,"timestamp_to_human":0,"timezon":10,"tld":3,"tls":[0,5,12],"to_domain":10,"to_utc":0,"togeth":[7,12],"token":[0,4,12],"token_fil":12,"tool":12,"top":[3,7,12],"topic":12,"touch":[3,8],"tracker":1,"trade":12,"tradit":[3,8],"trail":12,"transfer":10,"transient":0,"transpar":5,"transport":[4,12],"trash":12,"treat":0,"tri":[0,12],"troubleshoot":12,"true":[0,2,4,10,12],"trust":12,"truststor":4,"tuesday":6,"tune":5,"two":6,"txt":[0,12],"type":[5,7,10,12],"typeless":0,"typic":12,"typo":12,"u":[2,6,12],"ubuntu":[4,6],"udp":[0,12],"ui":[3,8],"unchang":[0,12],"uncondit":[3,8],"underlying":[0,12],"underneath":7,"underscor":12,"understand":[5,7],"unencrypt":12,"unexpir":12,"unfortun":[3,8],"unit":[0,2,12],"unix":0,"unknown":0,"unless":[6,12],"unreach":[0,12],"unread":12,"unrel":6,"unsubscrib":[3,8],"unsuit":12,"unus":0,"unzip":2,"updat":[0,4,6,12],"upersecur":12,"upgrad":[2,5,6,12],"upload":12,"upper":7,"uppercas":12,"uri":[6,12],"url":[0,2,12],"us":[10,12],"usabl":12,"usag":12,"use":[0,3,4,5,8,10],"use_ssl":0,"user":[0,2,3,4,6,7,8,10,12],"user_ag":10,"useradd":[2,6],"usernam":[0,12],"usernamepassword":12,"usesystemproxi":2,"usr":[4,6],"utc":[0,12],"utf":10,"util":5,"v":12,"valid":[0,7,10,12],"valimail":5,"valu":[0,3,4,7,8,12],"var":[3,8,12],"variabl":5,"variant":12,"various":6,"vendor":3,"venv":[6,12],"verbatim":12,"verbos":12,"veri":[4,7,12],"verif":[0,4,12],"verifi":0,"verification_mod":4,"version":[0,2,4,5,9,10,11,12],"vew":2,"via":[0,2],"view":[7,12],"vim":4,"virtualenv":6,"visual":[4,9],"volum":[7,12],"vulner":3,"w":[0,12],"w3c":10,"wait":[0,12],"wall":0,"want":[2,12],"wantedbi":[2,12],"warn":12,"watch":[0,2,4,6,12],"watch_inbox":0,"watcher":[0,12],"way":[0,4,7],"web":[2,4],"webdav":2,"webhook":[5,12],"webmail":[3,7,8],"week":[0,6,12],"well":[2,12],"wettbewerb":10,"wget":4,"whalensolut":12,"wheel":12,"whenev":[0,2,12],"wherea":7,"wherev":12,"whether":[0,12],"whi":[3,7,12],"whole":0,"whose":[0,12],"wide":[6,10,12],"wiki":10,"will":[0,2,3,4,6,7,8,12],"win":12,"window":[6,12],"within":0,"without":[3,4,6,7,8],"won":5,"work":[2,3,5,6,7,8,12],"worker":12,"workstat":2,"worst":[3,12],"worth":12,"wrap":[3,8],"wrapper":12,"write":[0,12],"written":12,"www":[4,6,12],"x":[0,4,7,10],"x509":4,"xennn":10,"xml":[0,11],"xml_schema":10,"xms4g":4,"xmx4g":4,"xpack":4,"xxxx":4,"y":[4,6],"yahoo":7,"yaml":12,"year":12,"yes":[3,8],"yet":[3,12],"yml":4,"yyyi":[0,12],"z":12,"zero":12,"zip":[0,2,5,12],"\u00fcbersicht":10},"titles":["API reference","Contributing to parsedmarc","Accessing an inbox using OWA/EWS","Understanding DMARC","Elasticsearch and Kibana","parsedmarc documentation - Open source DMARC report analyzer and visualizer","Installation","Using the Kibana dashboards","What about mailing lists?","OpenSearch and Grafana","Sample outputs","Splunk","Using parsedmarc"],"titleterms":{"Do":[3,8],"What":[3,8],"_file":12,"access":2,"aggreg":[7,10],"align":3,"analyz":[5,6],"api":0,"best":[3,8],"bug":1,"cli":12,"compat":5,"compos":12,"config":12,"configur":[2,12],"content":5,"contribut":1,"countri":6,"csv":10,"dashboard":7,"databas":6,"davmail":2,"depend":6,"dkim":3,"dmarc":[3,5,7],"docker":12,"document":5,"domain":3,"elast":0,"elasticsearch":4,"env":12,"environ":12,"ew":2,"exampl":12,"exchang":6,"failur":[7,10],"featur":5,"file":12,"geolite2":6,"grafana":9,"guid":3,"help":12,"inbox":2,"index":4,"indic":0,"instal":[4,6,9],"ip":6,"json":10,"kibana":[4,7],"list":[3,8],"listserv":[3,8],"lookalik":3,"mail":[3,8],"mailman":[3,8],"map":12,"maxmind":6,"microsoft":6,"mode":12,"multi":12,"multipl":6,"name":12,"onli":12,"open":5,"opensearch":[0,9],"option":6,"output":10,"owa":2,"parsedmarc":[0,1,2,5,6,12],"pattern":4,"perform":12,"practic":[3,8],"prerequisit":6,"proxi":6,"python":5,"record":[3,4,9],"refer":0,"reload":12,"report":[1,5,6,7,10],"resourc":3,"restart":12,"retent":[4,9],"run":[2,12],"sampl":10,"secret":12,"section":12,"sender":3,"servic":[2,12],"smtp":[7,10],"sourc":5,"specifi":12,"spf":3,"splunk":[0,11],"suffix":12,"support":[3,12],"systemd":[2,12],"t":3,"tabl":0,"tenant":12,"test":6,"tls":[7,10],"tune":12,"type":0,"understand":3,"upgrad":4,"use":[2,6,7,12],"util":0,"valid":3,"variabl":12,"via":12,"visual":5,"web":6,"without":12,"won":3,"workaround":[3,8]}}) \ No newline at end of file diff --git a/splunk.html b/splunk.html index 1113a1b3..773a34c2 100644 --- a/splunk.html +++ b/splunk.html @@ -6,14 +6,14 @@ - Splunk — parsedmarc 10.2.2 documentation + Splunk — parsedmarc 10.2.4 documentation - + diff --git a/usage.html b/usage.html index 38d72d8f..2add8133 100644 --- a/usage.html +++ b/usage.html @@ -6,14 +6,14 @@ - Using parsedmarc — parsedmarc 10.2.2 documentation + Using parsedmarc — parsedmarc 10.2.4 documentation - + @@ -357,7 +357,46 @@ for all auth methods except UsernamePassword.

      current user if using the UsernamePassword auth method, but could be a shared mailbox if the user has access to the mailbox

    • graph_url - str: Microsoft Graph URL. Allows for use of National Clouds (ex Azure Gov) -(Default: https://graph.microsoft.com)

      • +(Default: https://graph.microsoft.com)

      +
      +

      Warning

      +

      Setting graph_url alone is not sufficient for a national/sovereign +cloud tenant. It only changes the Microsoft Graph API root; the +Microsoft Entra ID (Azure AD) token endpoint used for authentication is +not currently configurable in parsedmarc or mailsuite, and always +defaults to the global https://login.microsoftonline.com. A true +national-cloud deployment also needs its own Entra ID endpoint, so +graph_url by itself only helps if your tenant is registered in the +global cloud but you specifically need to reach one of these Graph API +roots (per Microsoft’s national cloud deployment docs):

      + + + + + + + + + + + + + + + + + + + + + + + + + +

      National cloud

      Microsoft Graph URL

      Entra ID endpoint (not configurable here)

      Global (default)

      https://graph.microsoft.com

      https://login.microsoftonline.com

      US Government L4 (GCC High)

      https://graph.microsoft.us

      https://login.microsoftonline.us

      US Government L5 (DoD)

      https://dod-graph.microsoft.us

      https://login.microsoftonline.us

      China, operated by 21Vianet

      https://microsoftgraph.chinacloudapi.cn

      https://login.chinacloudapi.cn

      +
      +

    • token_file - str: Path to save the token file (Default: .token)

    • allow_unencrypted_storage - bool: Allows the Azure Identity @@ -365,12 +404,41 @@ module to fall back to unencrypted token cache (Default:

      Note

      +

      token_file stores the serialized authentication record; the +underlying MSAL persistent token cache is separately named +parsedmarc, not mailsuite’s own default cache name. This is +deliberate: the Graph mailbox backend used to live directly in +parsedmarc, and moved into the mailsuite dependency in parsedmarc +9.11.0. Explicitly keeping the parsedmarc cache name means tokens +cached before that move keep working after upgrading — there is +nothing to migrate and no action needed on your part.

      +
    +
    +

    Note

    You must create an app registration in Azure AD and have an admin grant the Microsoft Graph Mail.ReadWrite (delegated) permission to the app. If you are using UsernamePassword auth and the mailbox is different from the username, you must grant the app Mail.ReadWrite.Shared.

    + + + + + + + + + + + + + + + + + +

    Auth method

    Reading (own mailbox)

    Reading (shared mailbox)

    UsernamePassword / DeviceCode (delegated)

    Mail.ReadWrite

    Mail.ReadWrite.Shared

    ClientSecret / Certificate / ClientAssertion (application)

    Mail.ReadWrite (application), scoped via New-ApplicationAccessPolicy

    same as own mailbox — app-only access is scoped by policy, not by permission name

    Tip

    Troubleshooting connections. Run with --verbose to log a @@ -381,7 +449,12 @@ mailbox, Graph URL) before the connection attempt, and with from Entra ID, which distinguish a local configuration problem from an Exchange Online-side one), Microsoft Graph SDK requests, and httpx HTTP request lines. Secret values (passwords, client -secrets, certificate passwords) are never written to logs.

    +secrets, certificate passwords) are never written to logs. +Connection, mailbox fetch, message send, and --watch failures +each log a single ERROR line naming the mailbox, tenant, auth +method, and the Graph request-id/client-request-id when +available — worth quoting verbatim when contacting Microsoft +support.

    Warning

    @@ -401,6 +474,145 @@ group and use that as the group id.

    The same application permission and mailbox scoping guidance applies to the Certificate and ClientAssertion auth methods.

    +

    Sending the summary email via Microsoft Graph. +When [msgraph] is configured and [smtp] has a to value but no +host, the periodic summary email is sent through the same +already-authenticated Graph mailbox connection used for reading +(/users/{mailbox}/sendMail), and a copy is saved to Sent Items. +When [smtp] host is set, SMTP is used regardless of whether +[msgraph] is also configured — SMTP is always preferred, with no +automatic fallback to Graph on SMTP failure.

    +

    Example config combining [msgraph] with a [smtp] section that +only sets to/subject (no host):

    +
    [msgraph]
+auth_method = Certificate
+client_id = ...
+tenant_id = ...
+mailbox = dmarc-reports@example.com
+certificate_path = /path/to/cert.pem
+
+[smtp]
+to = admin@example.com
+subject = DMARC Summary
+
    +
    +

    Required Microsoft Graph permissions, in addition to the +reading-related permissions documented above:

    + + + + + + + + + + + + + + + + + + + + +

    Auth method

    Reading

    Sending (own mailbox)

    Sending (shared mailbox)

    UsernamePassword / DeviceCode (delegated)

    Mail.ReadWrite (+.Shared for shared)

    Mail.Send

    Mail.Send.Shared

    ClientSecret / Certificate / ClientAssertion (application)

    Mail.ReadWrite (application)

    Mail.Send (application)

    Mail.Send (application), scoped via New-ApplicationAccessPolicy

    +
    +

    Warning

    +

    Graph-based sending is only confirmed to work with the app-only +auth methods (ClientSecret, Certificate, ClientAssertion). +The delegated auth methods (UsernamePassword, DeviceCode) +currently request only the Mail.ReadWrite(.Shared) scope when +authenticating, not Mail.Send — so a delegated connection’s +access token will not carry Mail.Send even if an administrator +has granted it, and /sendMail calls are expected to fail with an +access-denied error regardless of what’s granted in Azure AD. Use +an app-only auth method if you need Graph-based sending.

    +
    +

    Minimal example configs. Each auth method needs a different +minimum set of keys. These read-only examples omit [smtp]; see +above for adding Graph-based sending on top of any of them.

    +

    UsernamePassword (delegated, own mailbox):

    +
    [msgraph]
+auth_method = UsernamePassword
+client_id = ...
+client_secret = ...
+user = dmarc-reports@example.com
+password = ...
+
    +
    +

    DeviceCode (delegated, interactive sign-in on first run — user +is the account that signs in; mailbox is the shared mailbox it +reads, and only needs to differ from user to request +Mail.ReadWrite.Shared instead of plain Mail.ReadWrite):

    +
    [msgraph]
+auth_method = DeviceCode
+client_id = ...
+tenant_id = ...
+user = signing-in-user@example.com
+mailbox = dmarc-reports@example.com
+
    +
    +

    ClientSecret (app-only):

    +
    [msgraph]
+auth_method = ClientSecret
+client_id = ...
+tenant_id = ...
+client_secret = ...
+mailbox = dmarc-reports@example.com
+
    +
    +

    Certificate (app-only):

    +
    [msgraph]
+auth_method = Certificate
+client_id = ...
+tenant_id = ...
+certificate_path = /path/to/cert.pem
+mailbox = dmarc-reports@example.com
+
    +
    +

    ClientAssertion (app-only, short-lived JWT — see the note above +about its unsuitability for watch mode):

    +
    [msgraph]
+auth_method = ClientAssertion
+client_id = ...
+tenant_id = ...
+client_assertion = ...
+mailbox = dmarc-reports@example.com
+
    +
    +
    +

    Tip

    +

    Troubleshooting.

    + + + + + + + + + + + + + + + + + + + + + + + + + +

    Error

    Cause

    Fix

    “…needs permission to access resources in your organization that only an admin can grant” / “Admin consent required”

    A delegated auth method (UsernamePassword, DeviceCode) is authenticating with a scope (Mail.ReadWrite or Mail.ReadWrite.Shared) the tenant admin hasn’t consented to yet.

    Have an Entra ID admin grant consent: Azure Portal → Enterprise Applications → your app → Permissions → Grant admin consent, or az ad app permission admin-consent --id <CLIENT_ID>. This is separate from the New-ApplicationAccessPolicy step above, which only applies to app-only auth.

    ErrorItemNotFound: ... Default folder Root not found

    mailsuite can resolve the well-known folders (Inbox, Archive, Drafts, Sent Items, Deleted Items, Junk Email) even when a mailbox’s folder hierarchy hasn’t fully provisioned, but a custom, non-well-known reports_folder name still fails to resolve on such a mailbox.

    Point reports_folder at (or under) one of the six well-known folder names above, or sign into the (shared) mailbox once via Outlook/OWA to force Exchange to provision it, then retry.

    RuntimeError: Event loop is closed

    Historical bug, fixed in mailsuite 2.0.2. Not reachable with the mailsuite>=2.2.2 this project requires.

    Confirm your installed mailsuite version is current (pip show mailsuite); upgrade if it’s somehow pinned below 2.0.2.

    Invalid/rejected timestamp in the since/receivedDateTime filter

    Historical bug (parsedmarc #706/#708): older versions appended a spurious Z to an already-UTC-offset ISO timestamp. Fixed since parsedmarc 9.5.1/9.5.5.

    Upgrade parsedmarc if you’re on a version older than 9.5.5.

    +
    @@ -495,20 +707,28 @@ verification (not recommended)

  • smtp

      -

    • host - str: The SMTP hostname

      • +

    • host - str: The SMTP hostname. Required unless [msgraph] is +configured, in which case omitting it sends the summary via +Microsoft Graph instead — see “Sending the summary email via +Microsoft Graph” above.

    • port - int: The SMTP port (Default: 25)

    • ssl - bool: Require SSL/TLS instead of using STARTTLS

    • skip_certificate_verification - bool: Skip certificate verification (not recommended)

      • -

    • user - str: the SMTP username

      • -

    • password - str: the SMTP password

      • -

    • from - str: The From header to use in the email

      • +

    • user - str: the SMTP username. SMTP-only; not used when sending +via Microsoft Graph.

      • +

    • password - str: the SMTP password. SMTP-only; not used when +sending via Microsoft Graph.

      • +

    • from - str: The From header to use in the email. SMTP-only. +When sent via Microsoft Graph, the message’s From is always the +[msgraph] mailbox — [smtp] from has no effect.

    • to - list: A list of email addresses to send to

    • subject - str: The Subject header to use in the email (Default: parsedmarc report)

      • -

    • attachment - str: The ZIP attachment filenames

      • +

    • attachment - str: The ZIP attachment filenames +(Default: DMARC-<YYYY-MM-DD>.zip)

    • message - str: The email message -(Default: Please see the attached parsedmarc report.)

      +(Default: Please see the attached DMARC results.)

      Note

      % characters must be escaped with another % character,