mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-02-17 07:03:58 +00:00
199 lines
9.8 KiB
HTML
199 lines
9.8 KiB
HTML
|
|
|
|
<!DOCTYPE html>
|
|
<html class="writer-html5" lang="en" data-content_root="./">
|
|
<head>
|
|
<meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<title>Using the Kibana dashboards — parsedmarc 9.0.10 documentation</title>
|
|
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=b86133f3" />
|
|
<link rel="stylesheet" type="text/css" href="_static/css/theme.css?v=9edc463e" />
|
|
|
|
|
|
<script src="_static/jquery.js?v=5d32c60e"></script>
|
|
<script src="_static/_sphinx_javascript_frameworks_compat.js?v=2cd50e6c"></script>
|
|
<script src="_static/documentation_options.js?v=164cc7e6"></script>
|
|
<script src="_static/doctools.js?v=fd6eb6e6"></script>
|
|
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
|
|
<script src="_static/js/theme.js"></script>
|
|
<link rel="index" title="Index" href="genindex.html" />
|
|
<link rel="search" title="Search" href="search.html" />
|
|
<link rel="next" title="Splunk" href="splunk.html" />
|
|
<link rel="prev" title="OpenSearch and Grafana" href="opensearch.html" />
|
|
</head>
|
|
|
|
<body class="wy-body-for-nav">
|
|
<div class="wy-grid-for-nav">
|
|
<nav data-toggle="wy-nav-shift" class="wy-nav-side">
|
|
<div class="wy-side-scroll">
|
|
<div class="wy-side-nav-search" >
|
|
|
|
|
|
|
|
<a href="index.html" class="icon icon-home">
|
|
parsedmarc
|
|
</a>
|
|
<div role="search">
|
|
<form id="rtd-search-form" class="wy-form" action="search.html" method="get">
|
|
<input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
|
|
<input type="hidden" name="check_keywords" value="yes" />
|
|
<input type="hidden" name="area" value="default" />
|
|
</form>
|
|
</div>
|
|
</div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
|
|
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
|
|
<ul class="current">
|
|
<li class="toctree-l1"><a class="reference internal" href="installation.html">Installation</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="usage.html">Using parsedmarc</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="output.html">Sample outputs</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="elasticsearch.html">Elasticsearch and Kibana</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="opensearch.html">OpenSearch and Grafana</a></li>
|
|
<li class="toctree-l1 current"><a class="current reference internal" href="#">Using the Kibana dashboards</a><ul>
|
|
<li class="toctree-l2"><a class="reference internal" href="#dmarc-summary">DMARC Summary</a></li>
|
|
<li class="toctree-l2"><a class="reference internal" href="#dmarc-forensic-samples">DMARC Forensic Samples</a></li>
|
|
</ul>
|
|
</li>
|
|
<li class="toctree-l1"><a class="reference internal" href="splunk.html">Splunk</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="davmail.html">Accessing an inbox using OWA/EWS</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="dmarc.html">Understanding DMARC</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="contributing.html">Contributing to parsedmarc</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="api.html">API reference</a></li>
|
|
</ul>
|
|
|
|
</div>
|
|
</div>
|
|
</nav>
|
|
|
|
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
|
|
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
|
|
<a href="index.html">parsedmarc</a>
|
|
</nav>
|
|
|
|
<div class="wy-nav-content">
|
|
<div class="rst-content">
|
|
<div role="navigation" aria-label="Page navigation">
|
|
<ul class="wy-breadcrumbs">
|
|
<li><a href="index.html" class="icon icon-home" aria-label="Home"></a></li>
|
|
<li class="breadcrumb-item active">Using the Kibana dashboards</li>
|
|
<li class="wy-breadcrumbs-aside">
|
|
<a href="_sources/kibana.md.txt" rel="nofollow"> View page source</a>
|
|
</li>
|
|
</ul>
|
|
<hr/>
|
|
</div>
|
|
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
|
|
<div itemprop="articleBody">
|
|
|
|
<section class="tex2jax_ignore mathjax_ignore" id="using-the-kibana-dashboards">
|
|
<h1>Using the Kibana dashboards<a class="headerlink" href="#using-the-kibana-dashboards" title="Link to this heading"></a></h1>
|
|
<p>The Kibana DMARC dashboards are a human-friendly way to understand the
|
|
results from incoming DMARC reports.</p>
|
|
<div class="admonition note">
|
|
<p class="admonition-title">Note</p>
|
|
<p>The default dashboard is DMARC Summary. To switch between dashboards,
|
|
click on the Dashboard link on the left side menu of Kibana.</p>
|
|
</div>
|
|
<section id="dmarc-summary">
|
|
<h2>DMARC Summary<a class="headerlink" href="#dmarc-summary" title="Link to this heading"></a></h2>
|
|
<p>As the name suggests, this dashboard is the best place to start
|
|
reviewing your aggregate DMARC data.</p>
|
|
<p>Across the top of the dashboard, three pie charts display the percentage of
|
|
alignment pass/fail for SPF, DKIM, and DMARC. Clicking on any chart segment
|
|
will filter for that value.</p>
|
|
<div class="admonition note">
|
|
<p class="admonition-title">Note</p>
|
|
<p>Messages should not be considered malicious just because they failed to pass
|
|
DMARC; especially if you have just started collecting data. It may be a
|
|
legitimate service that needs SPF and DKIM configured correctly.</p>
|
|
</div>
|
|
<p>Start by filtering the results to only show failed DKIM alignment. While DMARC
|
|
passes if a message passes SPF or DKIM alignment, only DKIM alignment remains
|
|
valid when a message is forwarded without changing the from address, which is
|
|
often caused by a mailbox forwarding rule. This is because DKIM signatures are
|
|
part of the message headers, whereas SPF relies on SMTP session headers.</p>
|
|
<p>Underneath the pie charts. you can see graphs of DMARC passage and message
|
|
disposition over time.</p>
|
|
<p>Under the graphs you will find the most useful data tables on the dashboard. On
|
|
the left, there is a list of organizations that are sending you DMARC reports.
|
|
In the center, there is a list of sending servers grouped by the base domain
|
|
in their reverse DNS. On the right, there is a list of email from domains,
|
|
sorted by message volume.</p>
|
|
<p>By hovering your mouse over a data table value and using the magnifying glass
|
|
icons, you can filter on our filter out different values. Start by looking at
|
|
the Message Sources by Reverse DNS table. Find a sender that you recognize,
|
|
such as an email marketing service, hover over it, and click on the plus (+)
|
|
magnifying glass icon, to add a filter that only shows results for that sender.
|
|
Now, look at the Message From Header table to the right. That shows you the
|
|
domains that a sender is sending as, which might tell you which brand/business
|
|
is using a particular service. With that information, you can contact them and
|
|
have them set up DKIM.</p>
|
|
<div class="admonition note">
|
|
<p class="admonition-title">Note</p>
|
|
<p>If you have a lot of B2C customers, you may see a high volume of emails as
|
|
your domains coming from consumer email services, such as Google/Gmail and
|
|
Yahoo! This occurs when customers have mailbox rules in place that forward
|
|
emails from an old account to a new account, which is why DKIM
|
|
authentication is so important, as mentioned earlier. Similar patterns may
|
|
be observed with businesses who send from reverse DNS addressees of
|
|
parent, subsidiary, and outdated brands.</p>
|
|
</div>
|
|
<p>Further down the dashboard, you can filter by source country or source IP
|
|
address.</p>
|
|
<p>Tables showing SPF and DKIM alignment details are located under the IP address
|
|
table.</p>
|
|
<div class="admonition note">
|
|
<p class="admonition-title">Note</p>
|
|
<p>Previously, the alignment tables were included in a separate dashboard
|
|
called DMARC Alignment Failures. That dashboard has been consolidated into
|
|
the DMARC Summary dashboard. To view failures only, use the pie chart.</p>
|
|
</div>
|
|
<p>Any other filters work the same way. You can also add your own custom temporary
|
|
filters by clicking on Add Filter at the upper right of the page.</p>
|
|
</section>
|
|
<section id="dmarc-forensic-samples">
|
|
<h2>DMARC Forensic Samples<a class="headerlink" href="#dmarc-forensic-samples" title="Link to this heading"></a></h2>
|
|
<p>The DMARC Forensic Samples dashboard contains information on DMARC forensic
|
|
reports (also known as failure reports or ruf reports). These reports contain
|
|
samples of emails that have failed to pass DMARC.</p>
|
|
<div class="admonition note">
|
|
<p class="admonition-title">Note</p>
|
|
<p>Most recipients do not send forensic/failure/ruf reports at all to avoid
|
|
privacy leaks. Some recipients (notably Chinese webmail services) will only
|
|
supply the headers of sample emails. Very few provide the entire email.</p>
|
|
</div>
|
|
</section>
|
|
</section>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
|
|
<a href="opensearch.html" class="btn btn-neutral float-left" title="OpenSearch and Grafana" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
|
|
<a href="splunk.html" class="btn btn-neutral float-right" title="Splunk" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
|
|
</div>
|
|
|
|
<hr/>
|
|
|
|
<div role="contentinfo">
|
|
<p>© Copyright 2018 - 2025, Sean Whalen and contributors.</p>
|
|
</div>
|
|
|
|
Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
|
|
<a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
|
|
provided by <a href="https://readthedocs.org">Read the Docs</a>.
|
|
|
|
|
|
</footer>
|
|
</div>
|
|
</div>
|
|
</section>
|
|
</div>
|
|
<script>
|
|
jQuery(function () {
|
|
SphinxRtdTheme.Navigation.enable(true);
|
|
});
|
|
</script>
|
|
|
|
</body>
|
|
</html> |