parsedmarc/splunk.py
def save_aggregate_reports_to_splunk(self, aggregate_reports):
        """
        Saves aggregate DMARC reports to Splunk

        Args:
            aggregate_reports: A list of aggregate report dictionaries
            to save in Splunk

        """
        logger.debug("Saving aggregate reports to Splunk")
        if type(aggregate_reports) == dict:
            aggregate_reports = [aggregate_reports]

        if len(aggregate_reports) < 1:
            return

        data = self._common_data.copy()
        json_str = ""
        for report in aggregate_reports:
            for record in report["records"]:
                new_report = dict()
                for metadata in report["report_metadata"]:
                    new_report[metadata] = report["report_metadata"][metadata]
                new_report["published_policy"] = report["policy_published"]
                new_report["source_ip_address"] = record["source"][
                    "ip_address"]
                new_report["source_country"] = record["source"]["country"]
                new_report["source_reverse_dns"] = record["source"][
                    "reverse_dns"]
                new_report["source_base_domain"] = record["source"][
                    "base_domain"]
                new_report["message_count"] = record["count"]
                new_report["disposition"] = record["policy_evaluated"][
                    "disposition"
                ]
                new_report["spf_aligned"] = record["alignment"]["spf"]
                new_report["dkim_aligned"] = record["alignment"]["dkim"]
                new_report["passed_dmarc"] = record["alignment"]["dmarc"]
                new_report["header_from"] = record["identifiers"][
                    "header_from"]
                new_report["envelope_from"] = record["identifiers"][
                    "envelope_from"]
                if "dkim" in record["auth_results"]:
                    new_report["dkim_results"] = record["auth_results"][
                        "dkim"]
                if "spf" in record["auth_results"]:
                    new_report["spf_results"] = record["auth_results"][
                        "spf"]

                data["sourcetype"] = "dmarc:aggregate"
                timestamp = human_timestamp_to_timestamp(
                    new_report["begin_date"])
                data["time"] = timestamp
                data["event"] = new_report.copy()
                json_str += "{0}\n".format(json.dumps(data))

        if not self.session.verify:
            logger.debug("Skipping certificate verification for Splunk HEC")
        try:
            response = self.session.post(self.url, data=json_str,
                                         timeout=self.timeout)
            response = response.json()
        except Exception as e:
            raise SplunkError(e.__str__())
        if response["code"] != 0:
            raise SplunkError(response["text"])
def save_aggregate_reports_to_splunk(self, aggregate_reports):
        logger.debug("Saving aggregate reports to Splunk")
        if type(aggregate_reports) == dict:
            aggregate_reports = [aggregate_reports]

        if len(aggregate_reports) < 1:
            return

        data = self._common_data.copy()
        json_str = ""
        for report in aggregate_reports:
            for record in report["records"]:
                new_report = dict()
                for metadata in report["report_metadata"]:
                    new_report[metadata] = report["report_metadata"][metadata]
                new_report["published_policy"] = report["policy_published"]
                new_report["source_ip_address"] = record["source"][
                    "ip_address"]
                new_report["source_country"] = record["source"]["country"]
                new_report["source_reverse_dns"] = record["source"][
                    "reverse_dns"]
                new_report["source_base_domain"] = record["source"][
                    "base_domain"]
                new_report["message_count"] = record["count"]
                new_report["disposition"] = record["policy_evaluated"][
                    "disposition"
                ]
                new_report["spf_aligned"] = record["alignment"]["spf"]
                new_report["dkim_aligned"] = record["alignment"]["dkim"]
                new_report["passed_dmarc"] = record["alignment"]["dmarc"]
                new_report["header_from"] = record["identifiers"][
                    "header_from"]
                new_report["envelope_from"] = record["identifiers"][
                    "envelope_from"]
                if "dkim" in record["auth_results"]:
                    new_report["dkim_results"] = record["auth_results"][
                        "dkim"]
                if "spf" in record["auth_results"]:
                    new_report["spf_results"] = record["auth_results"][
                        "spf"]

                data["sourcetype"] = "dmarc:aggregate"
                timestamp = human_timestamp_to_timestamp(
                    new_report["begin_date"])
                data["time"] = timestamp
                data["event"] = new_report.copy()
                json_str += "{0}\n".format(json.dumps(data))

        if not self.session.verify:
            logger.debug("Skipping certificate verification for Splunk HEC")
        try:
            response = self.session.post(self.url, data=json_str,
                                         timeout=self.timeout)
            response = response.json()
        except Exception as e:
            raise SplunkError(e.__str__())
        if response["code"] != 0:
            raise SplunkError(response["text"])
def save_aggregate_reports_to_splunk ( self , aggregate_reports ) : logger . debug ( "Saving aggregate reports to Splunk" ) if type ( aggregate_reports ) == dict : aggregate_reports = [ aggregate_reports ] if len ( aggregate_reports ) < 1 : return data = self . _common_data . copy ( ) json_str = "" for report in aggregate_reports : for record in report [ "records" ] : new_report = dict ( ) for metadata in report [ "report_metadata" ] : new_report [ metadata ] = report [ "report_metadata" ] [ metadata ] new_report [ "published_policy" ] = report [ "policy_published" ] new_report [ "source_ip_address" ] = record [ "source" ] [ "ip_address" ] new_report [ "source_country" ] = record [ "source" ] [ "country" ] new_report [ "source_reverse_dns" ] = record [ "source" ] [ "reverse_dns" ] new_report [ "source_base_domain" ] = record [ "source" ] [ "base_domain" ] new_report [ "message_count" ] = record [ "count" ] new_report [ "disposition" ] = record [ "policy_evaluated" ] [ "disposition" ] new_report [ "spf_aligned" ] = record [ "alignment" ] [ "spf" ] new_report [ "dkim_aligned" ] = record [ "alignment" ] [ "dkim" ] new_report [ "passed_dmarc" ] = record [ "alignment" ] [ "dmarc" ] new_report [ "header_from" ] = record [ "identifiers" ] [ "header_from" ] new_report [ "envelope_from" ] = record [ "identifiers" ] [ "envelope_from" ] if "dkim" in record [ "auth_results" ] : new_report [ "dkim_results" ] = record [ "auth_results" ] [ "dkim" ] if "spf" in record [ "auth_results" ] : new_report [ "spf_results" ] = record [ "auth_results" ] [ "spf" ] data [ "sourcetype" ] = "dmarc:aggregate" timestamp = human_timestamp_to_timestamp ( new_report [ "begin_date" ] ) data [ "time" ] = timestamp data [ "event" ] = new_report . copy ( ) json_str += "{0}\n" . format ( json . dumps ( data ) ) if not self . session . verify : logger . debug ( "Skipping certificate verification for Splunk HEC" ) try : response = self . session . post ( self . url , data = json_str , timeout = self . timeout ) response = response . json ( ) except Exception as e : raise SplunkError ( e . __str__ ( ) ) if response [ "code" ] != 0 : raise SplunkError ( response [ "text" ] )
Saves aggregate DMARC reports to Splunk

        Args:
            aggregate_reports: A list of aggregate report dictionaries
            to save in Splunk
Saves aggregate DMARC reports to Splunk