{"id":36236478,"url":"https://github.com/prbinu/dmarc-report-processor","last_synced_at":"2026-01-11T06:00:50.410Z","repository":{"id":26642641,"uuid":"30098602","full_name":"prbinu/dmarc-report-processor","owner":"prbinu","description":"Scripts to pull DMARC reports from your mailbox (imap client) and convert it to Splunk friendly comma-separated key-value format","archived":false,"fork":false,"pushed_at":"2018-03-18T05:58:13.000Z","size":153,"stargazers_count":94,"open_issues_count":3,"forks_count":24,"subscribers_count":16,"default_branch":"master","last_synced_at":"2025-01-19T03:41:42.730Z","etag":null,"topics":["attachment","dmarc","dmarc-convertor","dmarc-parser","dmarc-reports","gmail","imap","imap-client","python","splunk","xml-files"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/prbinu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-01-31T01:38:39.000Z","updated_at":"2024-12-07T08:30:47.000Z","dependencies_parsed_at":"2022-09-26T22:10:25.672Z","dependency_job_id":null,"html_url":"https://github.com/prbinu/dmarc-report-processor","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/prbinu/dmarc-report-processor","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prbinu%2Fdmarc-report-processor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prbinu%2Fdmarc-report-processor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prbinu%2Fdmarc-report-processor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prbinu%2Fdmarc-report-processor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/prbinu","download_url":"https://codeload.github.com/prbinu/dmarc-report-processor/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prbinu%2Fdmarc-report-processor/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28293188,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-11T04:44:51.577Z","status":"ssl_error","status_checked_at":"2026-01-11T04:44:44.232Z","response_time":60,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attachment","dmarc","dmarc-convertor","dmarc-parser","dmarc-reports","gmail","imap","imap-client","python","splunk","xml-files"],"created_at":"2026-01-11T06:00:27.236Z","updated_at":"2026-01-11T06:00:50.319Z","avatar_url":"https://github.com/prbinu.png","language":"Python","readme":"Script to pull DMARC records, process and pass it to splunk.\n \n**imap-client.py** - Pull attachments from mail imap server and store\nit in the given directory. This is a generic program that can be used to\nfetch emails and/or attachments using IMAP protocol.\n\n**dmarc-parser.py** - Convert the xml files to comma-seperated key=value\n pair (line oriented output for splunk). This script can handle large xml files\n\n**dmarc-convertor.sh** - An uber script to manage the workflow end-to-end:\n  1. Download attachments from mail server\n  2. Unzip the attachments\n  3. Parse unzipped xml files and convert it line oriented format for splunk\n\n### Usage\n\n#### imap-client.py\n\n``` \nimap-client.py [-h] [-v] [--attachmentsonly] [--disablereadonly]\n                      [--quiet] -s HOST [-p PORT] -c CACERTS -u USER -f FOLDER\n                      -o OUTDIR [-S SEARCH] [-P PWDFILE]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -v, --verbose         increase output verbosity\n  --attachmentsonly     download attachments only\n  --disablereadonly     enable state changes on server; Default readonly\n  --quiet               supress all comments (stdout)\n  -s HOST, --host HOST  imap server; eg. imap.mail.yahoo.com\n  -p PORT, --port PORT  imap server port; Default is 993\n  -c CACERTS, --cacerts CACERTS\n                        CA certificates, which are used to validate\n                        certificates passed from imap server\n  -u USER, --user USER  user's email id\n  -f FOLDER, --folder FOLDER\n                        mail folder from which the mail to retrieve\n  -o OUTDIR, --outdir OUTDIR\n                        directory to output\n  -S SEARCH, --search SEARCH\n                        search criteria, defined in IMAP RFC 3501; eg. \"SINCE\n                        \\\"8-Sep-2014\\\"\"\n  -P PWDFILE, --pwdfile PWDFILE\n                        A file that stores IMAP user password. If not set, the\n                        user is prompted to provide a passwd\n\nExample: \n  % imap-client.py -s imap.example.com -c ./cacert.pem -u dmarc@example.com -f inbox -o ./mymail -S \"SINCE \\\"8-Sep-2014\\\"\" -P\n./paswdfile\n```\n\n#### dmarc-parser.py\n\n```\ndmarc-parser.py [-h] dmarcfile\n\npositional arguments:\n  dmarcfile   dmarc file in XML format\n\noptional arguments:\n  -h, --help  show this help message and exit\n\nExample: \n  % dmarc-parser.py dmarc-xml-file 1\u003e outfile.csv\n```\n\n#### dmarc-convertor.sh\n\n```\ndmarc-convertor.sh -u user_emailid -s imapserver -c cacertfile [-p port] [-P pwdfile] [-h] \nOptions:\n    -u   User email id\n    -P   File that contains user password. Default: The user will be \n         prompted to provide password if you leave this option.\n         WARNING: The file should be with permission\n         0400 or 0440 (ie should NOT be world readable)\n    -s   IMAP server name\n    -p   IMAP port number. Default: 993\n    -c   CA certificate file (eg. cacert.pem), used to validate certificates\n         passed from IMAP server\n    -h   Help\n\nExample:\n  % dmarc-convertor.sh -u dmarc@example.com -P ./pwd -s imap.example.com -p 993 -c ./cacert.pem\n```\n\nThe\n\n```\n\tdmarcReportProcessor.service\n\tdmarcReportProcessor.timer\n```\n\nshows a possible systemd call to execute the report collection. The env RUAFOLDER defines the IMAP folder where the reports are.\n\n\n*NOTE* The above script expects `imap-client.py` and `dmarc-parser.py` available in $ROOT/bin. You may change the path by modifiying `dmarc-convertor.sh`. \n\nTested on python 2.7\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprbinu%2Fdmarc-report-processor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fprbinu%2Fdmarc-report-processor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprbinu%2Fdmarc-report-processor/lists"}