{"action_type": 3, "rfc2822_message_id": "<11111.@mail.rfc.lan>", "subject": "presale listings", "payload_size": 20855, "source": {"address": "216960@external_test_email.com", "service": "smtp-inbound", "selector": null, "from_header_address": "admin@external_test_email_research.com", "from_header_displayname": "montResearch"}, "destination": [{"address": "john@internal_test_email.com", "service": "gmail-ui", "selector": "", "smime_signature_verification_success": null, "smime_decryption_success": null, "smime_parsing_success": null, "smime_extraction_success": null, "rcpt_response": null}], "flattened_destinations": "gmail-ui::john@internal_test_email.com", "description": "No Error", "connection_info": {"client_ip": "null", "smtp_in_connect_ip": null, "smtp_out_connect_ip": null, "failed_smtp_out_connect_ip": [], "smtp_tls_state": 1, "smtp_reply_code": 0, "tls_required_but_unavailable": null, "smtp_out_remote_host": null, "smtp_user_agent_ip": "null", "is_intra_domain": false, "dmarc_pass": false, "dmarc_published_domain": null, "client_host_zone": "", "smtp_response_reason": null, "ip_geo_city": null, "ip_geo_country": "US", "authenticated_domain": [{"name": "external_test_email.com", "type": 6}, {"name": "external_test_email.com", "type": 1}], "is_internal": false, "dkim_pass": false, "spf_pass": true, "smtp_tls_version": null, "smtp_tls_cipher": null}, "is_spam": true, "is_policy_check_for_sender": false, "num_message_attachments": 0, "message_set": [{"type": 57}, {"type": 9}, {"type": 22}, {"type": 15}, {"type": 48}, {"type": 11}, {"type": 50}, {"type": 51}, {"type": 61}, {"type": 7}, {"type": 1}], "smtp_relay_error": null, "upload_error_category": null, "structured_policy_log_info": {"exchange_journal_info": null, "detected_file_types": []}, "triggered_rule_info": [{"policy_holder_address": "john@internal_test_email.com", "consequence": [{"action": 5, "reason": "null", "subconsequence": [{"action": 6, "reason": "null"}]}], "string_match": [], "spam_label_modifier": null, "rule_type": 25, "rule_name": "null"}], "flattened_triggered_rule_info": "[{\"policy_holder_address\":\"john@internal_test_email.com\",\"consequence\":[{\"action\":\"2\",\"reason\":\"null\",\"subconsequence\":[{\"action\":\"3\",\"reason\":\"null\"}]}],\"string_match\":[],\"rule_type\":\"25\",\"rule_name\":\"null\"}]", "smime_sign_message": null, "smime_encrypt_message": null, "smime_packaging_success": null, "smime_extraction_success": null, "smime_content_type": null, "link_domain": ["pastebin.com", "medium.com", "discordapp.com", "t.me"], "attachment": [], "spam_info": {"disposition": 2, "classification_reason": 11, "ip_whitelist_entry": "", "classification_timestamp_usec": null}, "timestamp": 1629719869.486158}