Aggregate DMARC data A summary of aggregate DMARC report data index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | rename spf_results{}.domain as envelope_domain spf_results{}.result as spf_result spf_results{}.scope as spf_scope dkim_results{}.selector as dkim_selector dkim_results{}.domain as dkim_domain dkim_results{}.result as dkim_result | fillnull value=null source_reverse_dns source_base_domain dkim_selector dkim_domain dkim_result source_type source_name source_as_name | search dkim_selector=$dkim_selector$ dkim_domain=$dkim_domain$ source_type="$source_type$" source_name="$source_name$" source_as_name="$source_as_name$" | table * $time_range.earliest$ $time_range.latest$

SPF alignment any true false * DKIM alignment any true false * Passed DMARC any true false * Reporting organization * Message header from * Envelope from * Message disposition any none quarantine reject * Source name * any * source_name source_name index="email" sourcetype="dmarc:aggregate" source_type="$source_type$" | stats count by source_name Source type * * any source_type source_type index="email" sourcetype="dmarc:aggregate" | stats count by source_type Source AS name any * * source_as_name source_as_name index="email" sourcetype="dmarc:aggregate" | stats count by source_as_name 0 Source IP address * Source reverse DNS * Source base domain * Source country ISO code * DKIM selector * DKIM domain * Time range -7d@h now

| stats sum(message_count) as message_count by spf_aligned pie none {"true":0x65a637,"false":0xd93f3c} | stats sum(message_count) by dkim_aligned pie none {"true":0x65a637,"false":0xd93f3c} 250 | stats sum(message_count) by passed_dmarc pie none {"true":0x65a637,"false":0xd93f3c} | stats sum(message_count) as message_count by org_name | sort -message_count noneprogressbar 0 | fillnull value="none" | stats sum(message_count) as message_count by source_base_domain | sort -message_count noneprogressbar 0 | stats sum(message_count) as Messages, sum(eval(if(passed_dmarc="true", message_count, 0))) as passed by header_from | eval "% DMARC Compliant"=if(Messages>0, round(passed/Messages*100, 1), null()) | fields - passed | rename header_from as "From Domain" | sort -Messages noneprogressbar 0 1 | stats sum(message_count) as message_count by source_name, source_type | sort -message_count noneprogressbar 0 | stats sum(message_count) as message_count by source_asn, source_as_name, source_as_domain | eval source_asn = if(isnotnull(source_asn) AND source_asn!="", "AS" . source_asn, source_asn) | sort -message_count noneprogressbar 0 | timechart span=1d sum(message_count) as message_count by passed_dmarc Time visible Messages visible visible line none {"true":0x65a637,"false":0xd93f3c} right 280 progressbar | timechart span=1d sum(message_count) as message_count by disposition Time Messages line zero none none {"none":0x65a637,"quarantine":0xf2b134,"reject":0xd93f3c} progressbar | stats sum(message_count) as message_count by source_country | sort -message_count 20nonefalseprogressbar 0 | fillnull value="none" source_reverse_dns source_base_domain | fillnull value="unknown" source_country | stats sum(message_count) as message_count by source_ip_address,source_reverse_dns,source_base_domain,source_country | sort -message_count noneprogressbar 0 | fillnull value="none" source_base_domain envelope_domain spf_scope spf_result | eval spf_signature=mvzip(mvzip(spf_scope, envelope_domain, " / "), spf_result, " / ") | mvexpand spf_signature | stats sum(message_count) as message_count by header_from, envelope_from, spf_signature, source_base_domain, spf_aligned | eval parts=split(spf_signature, " / "), spf_scope=mvindex(parts, 0), spf_domain=mvindex(parts, 1), spf_result=mvindex(parts, 2) | table header_from, envelope_from, spf_scope, spf_domain, spf_result, spf_aligned, source_base_domain, message_count | sort -message_count noneprogressbar 0 | fillnull value="none" source_base_domain | eval dkim_signature=mvzip(mvzip(dkim_selector, dkim_domain, " / "), dkim_result, " / ") | mvexpand dkim_signature | stats sum(message_count) as message_count by header_from, dkim_signature, dkim_aligned, source_base_domain | eval parts=split(dkim_signature, " / "), dkim_selector=mvindex(parts, 0), dkim_domain=mvindex(parts, 1), dkim_result=mvindex(parts, 2) | table header_from, dkim_selector, dkim_domain, dkim_result, dkim_aligned, source_base_domain, message_count | sort -message_count noneprogressbar 0