Commit Graph

1383 Commits

Author SHA1 Message Date
copilot-swe-agent[bot]
dab2aaffda Update documentation with comprehensive field listings and correct service type examples
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-14 16:56:54 +00:00
copilot-swe-agent[bot]
19e8b498d0 Add source enrichment fields to forensic events matching aggregate reports
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-14 16:45:26 +00:00
copilot-swe-agent[bot]
91ae56c029 Add Chronicle Ingestion API support as primary method with stdout as alternative
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-13 16:04:52 +00:00
copilot-swe-agent[bot]
e0818a22f4 Add IP enrichment fields to detection_fields for enhanced Chronicle filtering
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-13 15:29:11 +00:00
copilot-swe-agent[bot]
da43efa4bf Move DMARC dimensions to detection_fields for Chronicle dashboard support
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 18:54:30 +00:00
copilot-swe-agent[bot]
cf916509ea Add SMTP TLS test and fix YARA-L boolean comparisons
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 18:26:37 +00:00
copilot-swe-agent[bot]
6ad7233983 Preserve native types for booleans and integers in UDM output
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 16:29:51 +00:00
copilot-swe-agent[bot]
63f8334e27 Add SMTP TLS and parse error event examples to documentation
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 16:23:27 +00:00
copilot-swe-agent[bot]
1aa0147c33 Add mailbox monitoring examples to Google SecOps documentation
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 16:05:36 +00:00
copilot-swe-agent[bot]
e9b4170591 Fix YARA-L rules to match actual event_type values in output
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 15:43:16 +00:00
copilot-swe-agent[bot]
d3a314171f Replace Splunk SPL with YARA-L in Google SecOps search examples
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 15:31:18 +00:00
copilot-swe-agent[bot]
b7823253a4 Fix SMTP TLS report policy domain extraction
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 15:15:50 +00:00
copilot-swe-agent[bot]
1887460ab6 Address code review feedback: remove redundant condition and improve test
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 15:12:33 +00:00
copilot-swe-agent[bot]
c84ddb4e89 Add Google SecOps documentation and update README
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 15:10:30 +00:00
copilot-swe-agent[bot]
78c863bd12 Add Google SecOps output module implementation
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2026-01-09 15:07:47 +00:00
copilot-swe-agent[bot]
12b9b37026 Initial plan 2026-01-09 14:56:48 +00:00
Sean Whalen
0e3a4b0f06 9.0.9
Validate that a string is base64-encoded before trying to base64 decode it. (PRs #648 and #649)
2026-01-08 13:29:23 -05:00
maraspr
343b53ef18 remove newlines before b64decode (#649) 2026-01-08 12:24:20 -05:00
maraspr
792079a3e8 Validate that string is base64 (#648) 2026-01-08 10:15:27 -05:00
Sean Whalen
1f3a1fc843 Better typing 2025-12-29 17:14:54 -05:00
Sean Whalen
34fa0c145d 9.0.8
- Fix logging configuration not propagating to child parser processes (#646).
- Update `mailsuite` dependency to `?=1.11.1` to solve issues with iCloud IMAP (#493).
2025-12-29 17:07:38 -05:00
Copilot
6719a06388 Fix logging configuration not propagating to child parser processes (#646)
* Initial plan

* Fix logging configuration propagation to child parser processes

- Add _configure_logging() helper function to set up logging in child processes
- Modified cli_parse() to accept log_level and log_file parameters
- Pass current logging configuration from parent to child processes
- Logging warnings/errors from child processes now properly display

Fixes issue where logging handlers in parent process were not inherited by
child processes created via multiprocessing.Process(). Child processes now
configure their own logging with the same settings as the parent.

Tested with sample files and confirmed warnings from DNS exceptions in child
processes are now visible.

Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>

* Address code review feedback on logging configuration

- Use exact type check (type(h) is logging.StreamHandler) instead of isinstance
  to avoid confusion with FileHandler subclass
- Catch specific exceptions (IOError, OSError, PermissionError) instead of
  bare Exception when creating FileHandler
- Kept logging.ERROR as default to maintain consistency with existing behavior

Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2025-12-29 15:07:22 -05:00
Sean Whalen
eafa435868 Code cleanup 9.0.7 2025-12-29 14:32:05 -05:00
Sean Whalen
5d772c3b36 Bump version to 9.0.7 and update changelog with IMAP since option fix 2025-12-29 14:23:50 -05:00
Copilot
72cabbef23 Fix IMAP SEARCH SINCE date format to RFC 3501 DD-Mon-YYYY (#645)
* Initial plan

* Fix IMAP since option date format to use RFC 3501 compliant DD-Mon-YYYY format

Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
2025-12-29 14:18:48 -05:00
Sean Whalen
3d74cd6ac0 Update CHANGELOG with issue reference for email read status
Added a reference to issue #625 regarding email read status.
2025-12-29 12:10:19 -05:00
Tomáš Kováčik
d1ac59a016 fix #641 (#642)
* fix smtptls and forensic reports for GELF

* add policy_domain, policy_type and failed_session_count to record row

* Remove unused import of json in gelf.py

---------

Co-authored-by: Sean Whalen <44679+seanthegeek@users.noreply.github.com>
2025-12-29 12:05:07 -05:00
Anael Mobilia
7fdd53008f Update README.md (#644) 2025-12-29 10:36:21 -05:00
Sean Whalen
35331d4b84 Add parsedmarc.types module to API reference documentation 9.0.6 2025-12-25 17:24:45 -05:00
Sean Whalen
de9edd3590 Add note about email read status in Microsoft 365 to changelog 2025-12-25 17:16:39 -05:00
Sean Whalen
abf4bdba13 Add type annotations for SMTP TLS and forensic report structures 2025-12-25 16:39:33 -05:00
Sean Whalen
7b842740f5 Change file permissions for tests.py to make it executable 2025-12-25 16:02:33 -05:00
Sean Whalen
ebe3ccf40a Update changelog for version 9.0.6 and set version in constants.py 2025-12-25 16:01:25 -05:00
Sean Whalen
808285658f Refactor function parameters to use non-Optional types where applicable 2025-12-25 16:01:12 -05:00
Sean Whalen
bc1dae29bd Update mailsuite dependency version to 1.11.0 2025-12-25 15:32:27 -05:00
Sean Whalen
4b904444e5 Refactor and improve parsing and extraction functions
- Updated `extract_report` to handle various input types more robustly, removing unnecessary complexity and improving error handling.
- Simplified the handling of file-like objects and added checks for binary mode.
- Enhanced the `parse_report_email` function to streamline input processing and improve type handling.
- Introduced TypedDicts for better type safety in `utils.py`, specifically for reverse DNS and IP address information.
- Refined the configuration loading in `cli.py` to ensure boolean values are consistently cast to `bool`.
- Improved overall code readability and maintainability by restructuring and clarifying logic in several functions.
2025-12-25 15:30:20 -05:00
Sean Whalen
3608bce344 Remove unused import of Union and cast from cli.py 2025-12-24 16:53:22 -05:00
Sean Whalen
fe809c4c3f Add type ignore comments for Pyright in elastic.py and opensearch.py 2025-12-24 16:49:42 -05:00
Sean Whalen
a76c2f9621 More code cleanup 2025-12-24 16:36:59 -05:00
Sean Whalen
bb8f4002bf Use literal dicts instead of ordered dicts and other code cleanup 2025-12-24 15:04:10 -05:00
Sean Whalen
b5773c6b4a Fix etree import to type checkers don't complain 2025-12-24 14:37:38 -05:00
Sean Whalen
b99bd67225 Fix get_base_domain() typing 2025-12-24 14:32:05 -05:00
Sean Whalen
af9ad568ec Specify Python version requirements in pyproject.toml 2025-12-17 16:18:24 -05:00
Sean Whalen
748164d177 Fix #638 2025-12-17 16:09:26 -05:00
Sean Whalen
487e5e1149 Format on build 2025-12-12 15:56:52 -05:00
Sean Whalen
73010cf964 Use ruff for code formatting 2025-12-12 15:44:46 -05:00
Sean Whalen
a4a5475aa8 Fix another typo before releasing 9.0.5 2025-12-08 15:29:48 -05:00
Sean Whalen
dab78880df Actual 9.0.5 release
Fix typo
2025-12-08 15:26:58 -05:00
Sean Whalen
fb54e3b742 9.0.5
- Fix report type detection bug introduced in `9.0.4` (yanked).
2025-12-08 15:22:02 -05:00
Sean Whalen
6799f10364 9.0.4
Fixes

- Fix saving reports to OpenSearch ([#637](https://github.com/domainaware/parsedmarc/issues/637))
- Fix parsing certain DMARC failure/forensic reports
- Some fixes to type hints (incomplete, but published as-is due to the above bugs)
2025-12-08 13:26:59 -05:00