mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-07-29 11:54:55 +00:00
a421747a79
Adds a dropdown that filters every panel on the published DMARC policy (published_policy.p) or subdomain policy (published_policy.sp), mirroring the Message disposition dropdown's choices and default and sitting immediately before it, per the issue spec. Both fields are always present on parsedmarc-written events (sp defaults to p in the parser), so the wildcard default matches everything, consistent with the other raw-search filters. Also fixes the Splunk docs page's XML-files link, which still pointed at the pre-#736 splunk/ path and 404ed. Closes #854 Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
803 B
803 B
Splunk
Starting in version 4.3.0 parsedmarc supports sending aggregate and/or
failure DMARC data to a Splunk HTTP Event collector (HEC).
The project repository contains XML files for premade Splunk dashboards for aggregate and failure DMARC reports.
Copy and paste the contents of each file into a separate Splunk dashboard XML editor.
:::{warning}
Change all occurrences of index="email" in the XML to
match your own index name.
:::
The Splunk dashboards display the same content and layout as the Kibana dashboards, although the Kibana dashboards have slightly easier and more flexible filtering options.