diff --git a/.gitignore b/.gitignore index e443375..b5eaed7 100644 --- a/.gitignore +++ b/.gitignore @@ -108,7 +108,6 @@ ENV/ # I/O files output/ -*.xml *.zip *.gz *.csv @@ -122,4 +121,3 @@ output/ # Data files *.dat *.mmdb - diff --git a/splunk/dmarc_aggregate_dashboard.xml b/splunk/dmarc_aggregate_dashboard.xml new file mode 100644 index 0000000..7d26357 --- /dev/null +++ b/splunk/dmarc_aggregate_dashboard.xml @@ -0,0 +1,272 @@ +
+ + A summary of aggregate DMARC report data +
+ + + any + true + false + * + + + + any + true + false + * + + + + any + true + false + * + + + + * + + + + * + + + + * + + + + * + + + + * + + + + * + + + + any + none + quarantine + reject + * + + + + * + + + + * + + + + + -7d@h + now + + +
+ + + SPF alignment + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by spf_aligned + $time_range.earliest$ + $time_range.latest$ + + + + + + + DKIM alignment + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by dkim_aligned + $time_range.earliest$ + $time_range.latest$ + + + + + + + + Passed DMARC + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by passed_dmarc + $time_range.earliest$ + $time_range.latest$ + + + + + + + + + Reporting organizations + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by org_name | sort -sum(message_count) + $time_range.earliest$ + $time_range.latest$ + + + + + +
+ + + Message sources by reverse DNS + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | fillnull value="none" | chart sum(message_count) by source_base_domain | sort -sum(message_count) + $time_range.earliest$ + $time_range.latest$ + + + + + +
+ + + Message volume by header from + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by header_from | sort -sum(message_count) + $time_range.earliest$ + $time_range.latest$ + + + + + +
+ + + + + DMARC passage over time + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by _time,passed_dmarc + -7d@h + now + + + + + + + + + + + + + + + + Message disposition over time + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | chart sum(message_count) by _time,disposition + $time_range.earliest$ + $time_range.latest$ + + + + + + + + + + + Message volume by source country + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | iplocation source_ip_address | stats count by Country | geom geo_countries featureIdField="Country" + $time_range.earliest$ + $time_range.latest$ + + + + + + + + + + Source countries + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | stats sum(message_count) by source_country | sort -sum(message_count) + $time_range.earliest$ + $time_range.latest$ + + + + + + + +
+ + + + + Message sources by IP address + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | stats sum(message_count) by source_ip_address,source_reverse_dns,source_base_domain,source_country | sort -sum(message_count) + $time_range.earliest$ + $time_range.latest$ + + + + + +
+ + + + + SPF alignment details + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | fillnull value="none" | stats sum(message_count) by header_from,envelope_from,spf_results{}.result,spf_aligned,source_base_domain | sort -sum(message_count) + $time_range.earliest$ + $time_range.latest$ + + + + + +
+ + + + + DKIM alignment details + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=*$org_name$* source_reverse_dns=*$source_reverse_dns$* header_from=*$header_from$* envelope_from=*$envelope_from$* dkim_results{}.selector=*$dkim_selector$* dkim_results{}.domain=*$dkim_domain$* disposition=$disposition$ source_ip_address=*$source_ip_address$* source_country=$source_country$ | fillnull value="none" | stats sum(message_count) by header_from,dkim_results{}.selector,dkim_results{}.domain,dkim_results{}.result,dkim_aligned,source_base_domain | sort -sum(message_count) + $time_range.earliest$ + $time_range.latest$ + + +
+ + +
diff --git a/splunk/dmarc_forensic_dashboard.xml b/splunk/dmarc_forensic_dashboard.xml new file mode 100644 index 0000000..2a73b3d --- /dev/null +++ b/splunk/dmarc_forensic_dashboard.xml @@ -0,0 +1,98 @@ +
+ +
+ + + * + + + + * + + + + * + + + + * + + + + * + + + + * + + + + + -90d@d + now + + +
+ + + Forensic samples + + + index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=*$header_from$* parsed_sample.headers.To=*$header_to$* parsed_sample.headers.Subject=*$header_subject$* source.ip_address=*$source_ip_address$* source.reverse_dns=*$source_reverse_dns$* source.country=$source_country$ | fillnull value="none" | stats count by _time,parsed_sample.headers.From,parsed_sample.headers.To,parsed_sample.headers.Reply-To,parsed_sample.headers.Subject | sort -_time + $time_range.earliest$ + $time_range.latest$ + + + + + + +
+ + + + + Forensic samples by country + + + index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=*$header_from$* parsed_sample.headers.To=*$header_to$* parsed_sample.headers.Subject=*$header_subject$* source.ip_address=*$source_ip_address$* source.reverse_dns=*$source_reverse_dns$* source.country=$source_country$ | iplocation source.ip_address | stats count by Country | geom geo_countries featureIdField="Country" + $time_range.earliest$ + $time_range.latest$ + + + + + + + + + + Forensic samples by IP address + + + index="email" sourcetype="dmarc:forensic" sourcetype="dmarc:forensic" parsed_sample.headers.From=*$header_from$* parsed_sample.headers.To=*$header_to$* parsed_sample.headers.Subject=*$header_subject$* source.ip_address=*$source_ip_address$* source.reverse_dns=*$source_reverse_dns$* source.country=$source_country$ | fillnull value="none" | iplocation source.ip_address | stats count by source.ip_address,source.reverse_dns,Country | sort -count + $time_range.earliest$ + $time_range.latest$ + + + + + +
+ + + Forensic samples by country ISO code + + + index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=*$header_from$* parsed_sample.headers.To=*$header_to$* parsed_sample.headers.Subject=*$header_subject$* source.ip_address=*$source_ip_address$* source.reverse_dns=*$source_reverse_dns$* source.country=$source_country$ | stats count by source.country | sort - count + $time_range.earliest$ + $time_range.latest$ + + + + + +
+ + +