Could I get your advice on why this template I created for SPF and DMARC checks is not working #10576
-
id: spf-dmarc-detect
info:
name: SPF and DMARC Security Detection (Specific Checks)
author: Sri
severity: info
description: |
This template performs specific checks on SPF and DMARC records:
- SPF policy strength
- SPF record length validity
- DMARC policy strength
reference:
- https://tools.ietf.org/html/rfc7208 (SPF)
- https://tools.ietf.org/html/rfc7489 (DMARC)
tags: dns
dns:
- name: "{{FQDN}}"
type: TXT
extractors:
- type: regex
name: spf_record
regex:
- "v=spf1(.+)"
group: 1
- name: "_dmarc.{{FQDN}}"
type: TXT
extractors:
- type: regex
name: dmarc_record
regex:
- "v=DMARC1;(.+)"
group: 1
matchers:
- type: dsl
name: spf_policy_check
dsl:
- |
spf_record = tolower(dns_spf_record[0]);
spf_policy = contains(spf_record, '-all') ? 'Strong' :
contains(spf_record, '~all') ? 'Medium' :
contains(spf_record, '?all') ? 'Weak' :
contains(spf_record, '+all') ? 'No policy (permissive)' :
'Invalid or missing';
'SPF policy: ' + spf_policy
- type: dsl
name: spf_length_check
dsl:
- "len(dns_spf_record[0]) <= 255 ? 'SPF record length: Valid' : 'SPF record length: Too long, may be truncated'"
- type: dsl
name: dmarc_policy_check
dsl:
- |
dmarc_record = tolower(dns_dmarc_record[0]);
dmarc_policy = contains(dmarc_record, 'p=reject') ? 'Strong' :
contains(dmarc_record, 'p=quarantine') ? 'Medium' :
contains(dmarc_record, 'p=none') ? 'Weak' :
'Invalid or missing';
'DMARC policy: ' + dmarc_policy I'am getting the following error
|
Beta Was this translation helpful? Give feedback.
Replies: 3 comments
-
@ehsandeep or @rxerium could i please get some help. Thank you. |
Beta Was this translation helpful? Give feedback.
-
@dwisiswant0 any feedback? |
Beta Was this translation helpful? Give feedback.
-
Please make sure that the dns:
- a: b
c: d
-matchers: []
+ matchers: []
|
Beta Was this translation helpful? Give feedback.
Please make sure that the
matchers
key is indented under thedns
entry, aligned similarly to theextractors
key or previous keys.