Proofpoint Sender Analyzer

Improvements

• Modularization and decoupling to allow easier processing pipeline changes in the future as well as reporting.

Added

• Added option --no-default-exclude-domains to exclude default Proofpoint infrastructure.
• Added filter statistics associated with pre-filtering, this shows how many messages in the set were excluded

Messages excluded by empty senders: 1523573
Messages excluded by domain: 484664
Messages excluded by sender: 0
Messages excluded by constraint: 0

Fixes

• Fixed filtering options excluded_domains, restrict_domains, excluded_senders

Usage Options:

usage: senderstats [-h] [--version] -i <file> [<file> ...] -o <xlsx>
                   [--mfrom MFrom] [--hfrom HFrom] [--rcpts Rcpts]
                   [--rpath RPath] [--msgid MsgID] [--subject Subject]
                   [--size MsgSz] [--date Date] [--gen-hfrom] [--gen-rpath]
                   [--gen-alignment] [--gen-msgid] [--expand-recipients]
                   [--no-display-name] [--remove-prvs] [--decode-srs]
                   [--no-empty-hfrom] [--sample-subject]
                   [--excluded-domains <domain> [<domain> ...]]
                   [--restrict-domains <domain> [<domain> ...]]
                   [--excluded-senders <sender> [<sender> ...]]
                   [--date-format DateFmt] [--no-default-exclude-domains]

This tool helps identify the top senders based on smart search outbound
message exports.

Input / Output arguments (required):
  -i <file> [<file> ...], --input <file> [<file> ...]  Smart search files to
                                                       read.
  -o <xlsx>, --output <xlsx>                           Output file

Field mapping arguments (optional):
  --mfrom MFrom                                        CSV field of the
                                                       envelope sender
                                                       address.
                                                       (default=Sender)
  --hfrom HFrom                                        CSV field of the header
                                                       From: address.
                                                       (default=Header_From)
  --rcpts Rcpts                                        CSV field of the header
                                                       recipient addresses.
                                                       (default=Recipients)
  --rpath RPath                                        CSV field of the
                                                       Return-Path: address.
                                                       (default=Header_Return-
                                                       Path)
  --msgid MsgID                                        CSV field of the
                                                       message ID.
                                                       (default=Message_ID)
  --subject Subject                                    CSV field of the
                                                       Subject, only used if
                                                       --sample-subject is
                                                       specified.
                                                       (default=Subject)
  --size MsgSz                                         CSV field of message
                                                       size.
                                                       (default=Message_Size)
  --date Date                                          CSV field of message
                                                       date/time.
                                                       (default=Date)

Reporting control arguments (optional):
  --gen-hfrom                                          Generate report showing
                                                       the header From: data
                                                       for messages being
                                                       sent.
  --gen-rpath                                          Generate report showing
                                                       return path for
                                                       messages being sent.
  --gen-alignment                                      Generate report showing
                                                       envelope sender and
                                                       header From: alignment
  --gen-msgid                                          Generate report showing
                                                       parsed Message ID.
                                                       Helps determine the
                                                       sending system

Parsing behavior arguments (optional):
  --expand-recipients                                  Expand recipients
                                                       counts messages by
                                                       destination. E.g. 1
                                                       message going to 3
                                                       people, is 3 messages
                                                       sent.
  --no-display-name                                    Remove display and use
                                                       address only. Converts
                                                       'Display Name
                                                       <user@domain.com>' to
                                                       'user@domain.com'
  --remove-prvs                                        Remove return path
                                                       verification strings
                                                       e.g. prvs=tag=sender@do
                                                       main.com
  --decode-srs                                         Convert sender rewrite
                                                       scheme, forwardmailbox+
                                                       srs=hash=tt=domain.com=
                                                       user to user@domain.com
  --no-empty-hfrom                                     If the header From: is
                                                       empty the envelope
                                                       sender address is used
  --sample-subject                                     Enable probabilistic
                                                       random sampling of
                                                       subject lines found
                                                       during processing
  --excluded-domains <domain> [<domain> ...]           Exclude domains from
                                                       processing.
  --restrict-domains <domain> [<domain> ...]           Constrain domains for
                                                       processing.
  --excluded-senders <sender> [<sender> ...]           Exclude senders from
                                                       processing.
  --date-format DateFmt                                Date format used to
                                                       parse the timestamps. (
                                                       default=%Y-%m-%dT%H:%M:
                                                       %S.%f%z)

Extended processing controls (optional):
  --no-default-exclude-domains                         Will not include the
                                                       default Proofpoint
                                                       excluded domains.

Usage:
  -h, --help                                           Show this help message
                                                       and exit
  --version                                            Show the program's
                                                       version and exit

Full Changelog: v2.0.4...v2.0.5