# Need help in parsing DMARC report in XML format **URL:** \ **Category:** Logstash\ **Created:** [November 28, 2018, 3:22am UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446 "2018-11-28T03:22:59Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [November 28, 2018, 3:22am UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/1 "2018-11-28T03:22:59Z")
Hi team, I am receiving XML report for our domain in XML formar and wanted to know if it can parsed using logstash so that data can be visualized in Kibana? Please suggest. ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [November 29, 2018, 8:16pm UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/2 "2018-11-29T20:16:55Z")
I created a thing just for that. Have you checked out ElasticMARC? > **[wwalker0307/ElasticMARC](https://github.com/wwalker0307/ElasticMARC)** > > DMARC Aggregate report digest and analysis for Windows utilizing the Elastic Stack - wwalker0307/ElasticMARC ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [November 30, 2018, 3:52pm UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/3 "2018-11-30T15:52:27Z")
Does this resolve the issue for you or is there something wrong with that solution? ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [December 1, 2018, 2:34am UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/4 "2018-12-01T02:34:59Z")
Hello, Sorry I havent had a chance to look at. Let me look at it and revert Thanks for the help. 🙂 ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [December 1, 2018, 3:30am UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/5 "2018-12-01T03:30:42Z")
Does this Windows system? I am looking for logstash file for parsing XML files. Or any other alternate available so that reports coming in can be parsed on linux? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [December 2, 2018, 3:02am UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/6 "2018-12-02T03:02:40Z")
Not quite sure what you are asking. It's for parsing dmarc aggregate reports. The readme is geared towards setting up Elastic Stack on a Windows platform but most of it can be used on a Linux setup as well. ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [December 2, 2018, 4:00am UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/7 "2018-12-02T04:00:58Z")
Correct this is what I am asking for. I wanted to have everything works on Linux but not sure what does powershell script do here. Wondering what are changes needed to make it work on Linux? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [December 2, 2018, 5:33am UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/8 "2018-12-02T05:33:46Z")
The script does the following: Connect to a _ **Microsoft Exchange** _ mailbox Download the aggregate report Relocate the email to an alternate folder Decompress the aggregate report Restructure the XML nodes (see below for reasoning) Save the new XML document to an ingest folder (or other place you prefer) In the default format, the `report_metadata` and `policy_published` nodes exist outside of the `record` node. I saw this as a bit of a problem because I wanted the published policy and metadata to exist alongside each record. The script duplicates these nodes into each record in the XML file so that each event has it. If you don't care about any of that, then the rest of it will work. You'll need to rewrite/omit a couple of the XPath statements in the logstash pipeline for the `metadata` and `policy nodes` but otherwise, everything else will work. Unfortunately, I am not skilled with Linux or Ruby so I have no idea how to accomplish the same thing without PowerShell, though I am 100% confident it can be done. ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [December 2, 2018, 5:51am UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/9 "2018-12-02T05:51:31Z")
Thanks let me work. Well if I dont have exchange and mails can even be pulled up from IMAP protocol from other mail servers or even with exchange servers? Then only thing remaining is parsing the XML reports. Which I need to dig further. ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [December 3, 2018, 5:05pm UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/10 "2018-12-03T17:05:15Z")
Since the environment I work in uses Exchange and has IMAP disabled, that's the solution I developed for. I don't know IMAP well but if you are able to develop an IMAP script I would be more than happy to include it in the repo. If you're able to develop any Linux/OS agnostic script I would be more than happy to have it included into the repo and, obviously, give credit where it is due. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 31, 2018, 5:05pm UTC](https://discuss.elastic.co/t/need-help-in-parsing-dmarc-report-in-xml-format/158446/11 "2018-12-31T17:05:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.