mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-04-30 01:09:28 +00:00
215 lines
11 KiB
HTML
215 lines
11 KiB
HTML
|
||
|
||
<!DOCTYPE html>
|
||
<html class="writer-html5" lang="en" data-content_root="./">
|
||
<head>
|
||
<meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||
<title>Using the Kibana dashboards — parsedmarc 9.11.0 documentation</title>
|
||
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=b86133f3" />
|
||
<link rel="stylesheet" type="text/css" href="_static/css/theme.css?v=e59714d7" />
|
||
|
||
|
||
<script src="_static/jquery.js?v=5d32c60e"></script>
|
||
<script src="_static/_sphinx_javascript_frameworks_compat.js?v=2cd50e6c"></script>
|
||
<script src="_static/documentation_options.js?v=4dc34ad6"></script>
|
||
<script src="_static/doctools.js?v=9bcbadda"></script>
|
||
<script src="_static/sphinx_highlight.js?v=dc90522c"></script>
|
||
<script src="_static/js/theme.js"></script>
|
||
<link rel="index" title="Index" href="genindex.html" />
|
||
<link rel="search" title="Search" href="search.html" />
|
||
<link rel="next" title="Splunk" href="splunk.html" />
|
||
<link rel="prev" title="OpenSearch and Grafana" href="opensearch.html" />
|
||
</head>
|
||
|
||
<body class="wy-body-for-nav">
|
||
<div class="wy-grid-for-nav">
|
||
<nav data-toggle="wy-nav-shift" class="wy-nav-side">
|
||
<div class="wy-side-scroll">
|
||
<div class="wy-side-nav-search" >
|
||
|
||
|
||
|
||
<a href="index.html" class="icon icon-home">
|
||
parsedmarc
|
||
</a>
|
||
<div role="search">
|
||
<form id="rtd-search-form" class="wy-form" action="search.html" method="get">
|
||
<input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
|
||
<input type="hidden" name="check_keywords" value="yes" />
|
||
<input type="hidden" name="area" value="default" />
|
||
</form>
|
||
</div>
|
||
</div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
|
||
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
|
||
<ul class="current">
|
||
<li class="toctree-l1"><a class="reference internal" href="installation.html">Installation</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="usage.html">Using parsedmarc</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="output.html">Sample outputs</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="elasticsearch.html">Elasticsearch and Kibana</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="opensearch.html">OpenSearch and Grafana</a></li>
|
||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Using the Kibana dashboards</a><ul>
|
||
<li class="toctree-l2"><a class="reference internal" href="#dmarc-aggregate-reports">DMARC aggregate reports</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#dmarc-failure-reports">DMARC failure reports</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#smtp-tls-reporting">SMTP TLS reporting</a></li>
|
||
</ul>
|
||
</li>
|
||
<li class="toctree-l1"><a class="reference internal" href="splunk.html">Splunk</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="davmail.html">Accessing an inbox using OWA/EWS</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="dmarc.html">Understanding DMARC</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="contributing.html">Contributing to parsedmarc</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="api.html">API reference</a></li>
|
||
</ul>
|
||
|
||
</div>
|
||
</div>
|
||
</nav>
|
||
|
||
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
|
||
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
|
||
<a href="index.html">parsedmarc</a>
|
||
</nav>
|
||
|
||
<div class="wy-nav-content">
|
||
<div class="rst-content">
|
||
<div role="navigation" aria-label="Page navigation">
|
||
<ul class="wy-breadcrumbs">
|
||
<li><a href="index.html" class="icon icon-home" aria-label="Home"></a></li>
|
||
<li class="breadcrumb-item active">Using the Kibana dashboards</li>
|
||
<li class="wy-breadcrumbs-aside">
|
||
<a href="_sources/kibana.md.txt" rel="nofollow"> View page source</a>
|
||
</li>
|
||
</ul>
|
||
<hr/>
|
||
</div>
|
||
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
|
||
<div itemprop="articleBody">
|
||
|
||
<section class="tex2jax_ignore mathjax_ignore" id="using-the-kibana-dashboards">
|
||
<h1>Using the Kibana dashboards<a class="headerlink" href="#using-the-kibana-dashboards" title="Link to this heading"></a></h1>
|
||
<p>The Kibana DMARC dashboards are a human-friendly way to understand the
|
||
results from incoming DMARC reports.</p>
|
||
<p>There is no separate Kibana export — Kibana 8.x’s saved-object migration
|
||
handlers accept the OpenSearch Dashboards format directly, so Kibana
|
||
users import the bundled
|
||
<a class="reference external" href="https://raw.githubusercontent.com/domainaware/parsedmarc/master/dashboards/opensearch/opensearch_dashboards.ndjson"><code class="docutils literal notranslate"><span class="pre">dashboards/opensearch/opensearch_dashboards.ndjson</span></code></a>
|
||
in <em>Stack Management → Saved Objects → Import</em>. A CI check imports the
|
||
same file into a Kibana 8.x container on every change so this stays
|
||
compatible.</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>The default dashboard is DMARC aggregate reports. To switch between
|
||
dashboards, click on the Dashboard link on the left side menu of Kibana.</p>
|
||
</div>
|
||
<section id="dmarc-aggregate-reports">
|
||
<h2>DMARC aggregate reports<a class="headerlink" href="#dmarc-aggregate-reports" title="Link to this heading"></a></h2>
|
||
<p>As the name suggests, this dashboard is the best place to start
|
||
reviewing your aggregate DMARC data.</p>
|
||
<p>Across the top of the dashboard, three pie charts display the percentage of
|
||
alignment pass/fail for SPF, DKIM, and DMARC. Clicking on any chart segment
|
||
will filter for that value.</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>Messages should not be considered malicious just because they failed to pass
|
||
DMARC; especially if you have just started collecting data. It may be a
|
||
legitimate service that needs SPF and DKIM configured correctly.</p>
|
||
</div>
|
||
<p>Start by filtering the results to only show failed DKIM alignment. While DMARC
|
||
passes if a message passes SPF or DKIM alignment, only DKIM alignment remains
|
||
valid when a message is forwarded without changing the from address, which is
|
||
often caused by a mailbox forwarding rule. This is because DKIM signatures are
|
||
part of the message headers, whereas SPF relies on SMTP session headers.</p>
|
||
<p>Underneath the pie charts. you can see graphs of DMARC passage and message
|
||
disposition over time.</p>
|
||
<p>Under the graphs you will find the most useful data tables on the dashboard. On
|
||
the left, there is a list of organizations that are sending you DMARC reports.
|
||
In the center, there is a list of sending servers grouped by the base domain
|
||
in their reverse DNS. On the right, there is a list of email from domains,
|
||
sorted by message volume.</p>
|
||
<p>By hovering your mouse over a data table value and using the magnifying glass
|
||
icons, you can filter on our filter out different values. Start by looking at
|
||
the Message Sources by Reverse DNS table. Find a sender that you recognize,
|
||
such as an email marketing service, hover over it, and click on the plus (+)
|
||
magnifying glass icon, to add a filter that only shows results for that sender.
|
||
Now, look at the Message From Header table to the right. That shows you the
|
||
domains that a sender is sending as, which might tell you which brand/business
|
||
is using a particular service. With that information, you can contact them and
|
||
have them set up DKIM.</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>If you have a lot of B2C customers, you may see a high volume of emails as
|
||
your domains coming from consumer email services, such as Google/Gmail and
|
||
Yahoo! This occurs when customers have mailbox rules in place that forward
|
||
emails from an old account to a new account, which is why DKIM
|
||
authentication is so important, as mentioned earlier. Similar patterns may
|
||
be observed with businesses who send from reverse DNS addressees of
|
||
parent, subsidiary, and outdated brands.</p>
|
||
</div>
|
||
<p>Further down the dashboard, you can filter by source country or source IP
|
||
address.</p>
|
||
<p>Tables showing SPF and DKIM alignment details are located under the IP address
|
||
table.</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>The alignment tables (SPF details, DKIM details) and the per-IP source
|
||
table live on the same dashboard, further down. To view failures only,
|
||
use the pie chart at the top of the page as a filter.</p>
|
||
</div>
|
||
<p>Any other filters work the same way. You can also add your own custom temporary
|
||
filters by clicking on Add Filter at the upper right of the page.</p>
|
||
</section>
|
||
<section id="dmarc-failure-reports">
|
||
<h2>DMARC failure reports<a class="headerlink" href="#dmarc-failure-reports" title="Link to this heading"></a></h2>
|
||
<p>The DMARC failure reports dashboard (formerly DMARC Forensic Samples) contains
|
||
information on DMARC failure reports (also known as forensic or ruf reports).
|
||
These reports contain samples of emails that have failed to pass DMARC.</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>Most recipients do not send forensic/failure/ruf reports at all to avoid
|
||
privacy leaks. Some recipients (notably Chinese webmail services) will only
|
||
supply the headers of sample emails. Very few provide the entire email.</p>
|
||
</div>
|
||
</section>
|
||
<section id="smtp-tls-reporting">
|
||
<h2>SMTP TLS reporting<a class="headerlink" href="#smtp-tls-reporting" title="Link to this heading"></a></h2>
|
||
<p>The SMTP TLS reporting dashboard surfaces aggregate counts of TLS-RPT
|
||
reporting organizations, the policy domains they report on, and the
|
||
specific failure types — certificate expiry, STARTTLS not supported,
|
||
STS policy fetch errors, validation failures, and similar — together with
|
||
the sending and receiving MTA addresses involved.</p>
|
||
</section>
|
||
</section>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
|
||
<a href="opensearch.html" class="btn btn-neutral float-left" title="OpenSearch and Grafana" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
|
||
<a href="splunk.html" class="btn btn-neutral float-right" title="Splunk" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<div role="contentinfo">
|
||
<p>© Copyright 2018 - 2025, Sean Whalen and contributors.</p>
|
||
</div>
|
||
|
||
Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
|
||
<a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
|
||
provided by <a href="https://readthedocs.org">Read the Docs</a>.
|
||
|
||
|
||
</footer>
|
||
</div>
|
||
</div>
|
||
</section>
|
||
</div>
|
||
<script>
|
||
jQuery(function () {
|
||
SphinxRtdTheme.Navigation.enable(true);
|
||
});
|
||
</script>
|
||
|
||
</body>
|
||
</html> |