820 <6> 2024-07-26T14:04:34Z ip-100-69-16-230.us-east-2.compute.internal ESS70460[1]: {"message_id":"1722002664-110375-12645-78455-1","src_ip":"100.69.13.140","hdr_from":"Amber Lee \u003camber.lee@oscorp.org\u003e","account_id":"ESS70460","domain_id":"158260","ptr_record":"","attoscorpments":[{"name":"Residential-Lease-Agreement_2022_05_27 2.pdf"}],"recipients":[{"action":"allowed","reason":"ui_delivered","reason_extra":"","delivered":"delivered","delivery_detail":"17.57.152.5:25:250 2.0.0 Ok: queued as EE9B5C01646","email":"stoves.tiffany@icloud.com","taxonomy":"policy"}],"hdr_to":"\"Stoves.tiffany@icloud.com\" \u003cStoves.tiffany@icloud.com\u003e","recipient_count":1,"dst_domain":"oscorp.org","size":113525,"subject":"Fwd: ","env_from":"amber.lee@oscorp.org","timestamp":"2024-07-26T14:04:31+0000","geoip":"","tls":true}
{
    "fieldExtractorName": "barracuda_ess",
    "message": "820 <6> 2024-07-26T14:04:34Z ip-100-69-16-230.us-east-2.compute.internal ESS70460[1]: {\"message_id\":\"1722002664-110375-12645-78455-1\",\"src_ip\":\"100.69.13.140\",\"hdr_from\":\"Amber Lee \\u003camber.lee@oscorp.org\\u003e\",\"account_id\":\"ESS70460\",\"domain_id\":\"158260\",\"ptr_record\":\"\",\"attoscorpments\":[{\"name\":\"Residential-Lease-Agreement_2022_05_27 2.pdf\"}],\"recipients\":[{\"action\":\"allowed\",\"reason\":\"ui_delivered\",\"reason_extra\":\"\",\"delivered\":\"delivered\",\"delivery_detail\":\"17.57.152.5:25:250 2.0.0 Ok: queued as EE9B5C01646\",\"email\":\"stoves.tiffany@icloud.com\",\"taxonomy\":\"policy\"}],\"hdr_to\":\"\\\"Stoves.tiffany@icloud.com\\\" \\u003cStoves.tiffany@icloud.com\\u003e\",\"recipient_count\":1,\"dst_domain\":\"oscorp.org\",\"size\":113525,\"subject\":\"Fwd: \",\"env_from\":\"amber.lee@oscorp.org\",\"timestamp\":\"2024-07-26T14:04:31+0000\",\"geoip\":\"\",\"tls\":true}",
    "messageType": "email_protection",
    "senderHost": "egress.ess.barracudanetworks.com",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "barracuda_ess",
    "tags": [
        "barracuda_ess",
        "email_protection"
    ]
}