Comments (5)
Hello @fraserhess
Thanks for use the app, hope it helps you!
I don't see how this can happen I tested it with different values and it just gets the info from that row, can you provided a xml that has this problem so I can test it.
The line you say that has the problem in it is a line to make sure that after each row of info the report_recorddata
variable is reset with the default info that applies to each line. the content of the report_defaultdata
is the info between the <report_medata>
tags and the <policy_published>
tags:
<report_metadata>
<org_name>ORGINAZATION</org_name>
<email>[email protected]</email>
<extra_contact_info>done call us</extra_contact_info>
<report_id>[email protected]</report_id>
<date_range>
<begin>1566943204</begin>
<end>1567029604</end>
</date_range>
</report_metadata>
<policy_published>
<domain>recipient-domain.nl</domain>
<adkim>r</adkim>
<aspf>r</aspf>
<p>quarantine</p>
<sp></sp>
<pct>100</pct>
</policy_published>
After the above the info about the sending systems and the actions they took is in the XML and that is different for each <record>
:
<record>
<row>
<source_ip>12.34.56.78</source_ip>
<count>1</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>fail</dkim>
<spf>pass</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>recipient-domain.nl</header_from>
<envelope_from>recipient-domain.nl</envelope_from>
</identifiers>
<auth_results>
<spf>
<domain>recipient-domain.nl</domain>
<scope>mfrom</scope>
<result>pass</result>
</spf>
</auth_results>
</record>
from ta-dmarc.
I do have a file that demonstrates the problem. It is attached and is an actual DMARC report from Google truncated to 4 records for testing purposes. The first two records (1 and 2) are DMARC passes and have DKIM auth results including a selector. The second two records (3 and 4) are DMARC quarantines and do not have DKIM auth results in the XML but they do in the json output in Splunk. In fact, they have the DKIM auth results from record 2.
google.com!pinnacol.com!1598140800!1598227199-trim.xml.zip
from ta-dmarc.
For more information see example 2 on this page:
https://www.programiz.com/python-programming/methods/dictionary/copy
When you copy by assignment (=) changes are made to both the copy and the original. Using the (shallow) copy function also isn't sufficient because the data structure here has dictionaries inside other dictionaries. A deep copy is required.
from ta-dmarc.
cool thanks I didn't know and didn't run into that problem before (or I just didn't see it....) I will look over the code and see where I need to change things. I will probably have a new version tomorrow..
Thanks for the info and the new insight
from ta-dmarc.
I created a new release (v3.7.0) with the suggested fix, thanks again for that. I also found another problem by accident when I processed the provided zip file. You apparently created that on a Mac and there was a "__MACOS" folder inside the zip, that caused an exception.
from ta-dmarc.
Related Issues (12)
- TA-dmarc fails to install HOT 4
- Unable to setup, python error in splunk HOT 3
- Is it possible to give this app as splunk downloadables as this is not available in splunkbase HOT 1
- App does not run, no logs etc. HOT 21
- Not Compatible with Splunk 8.1 HOT 3
- TA-dmarc installation issue HOT 3
- New MS DMARC aggregation reports not processed HOT 1
- MS Basic authentication support ended HOT 3
- Did not receive a session key from splunkd. Please enable passAuth in inputs.conf for this script HOT 1
- UTF-8 subject decoding HOT 1
- Error getting mail from O365 "No folders found" HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ta-dmarc.