{
  "_index": "logstash-smtp-2022.09.11",
  "_type": "_doc",
  "_id": "5AjnLYMBfTCdXV7aTnUS",
  "_version": 1,
  "_score": null,
  "_source": {
    "input": {
      "type": "log"
    },
    "proto": "TCP",
    "log": {
      "offset": 1248446699,
      "file": {
        "path": "/var/log/suricata/eve-0.json"
      }
    },
    "src_port": 49647,
    "see_id": "2e2cf4a77cbd",
    "smtp": {
      "helo": "[173.66.46.112]",
      "mail_from": "<koumu-yjitsugyo@world.odn.ne.jp>",
      "rcpt_to": [
        "<Simon.Chevalier@bnc.ca>"
      ]
    },
    "src_ip": "10.3.1.101",
    "net_info": {
      "src": [
        "USER.govux.org",
        "AFFECTED USERS"
      ],
      "src_agg": "user.govux.org.affected-users"
    },
    "@version": "1",
    "@timestamp": "2022-09-11T18:54:29.495Z",
    "ether": {
      "dest_mac": "20:e5:2a:b6:93:f1",
      "src_mac": "00:08:02:1c:47:ae"
    },
    "host": "SSProbe-1",
    "ecs": {
      "version": "1.12.0"
    },
    "dest_port": 25,
    "type": "json-log",
    "tags": [
      "beats_input_codec_json_applied"
    ],
    "tx_id": 0,
    "timestamp": "2022-09-11T20:54:29.495006+0200",
    "email": {
      "subject": "Re: Chevalier, Simon",
      "attachment": [
        "Invoice # 70376706 A#90739621 4407.zip"
      ],
      "url": [
        "http://www.bnc.ca"
      ],
      "date": "Tue, 01 Mar 2022 19:26:17 +0000",
      "from": "\"Bnc\" <koumu-yjitsugyo@world.odn.ne.jp>",
      "to": [
        "\"Chevalier",
        "Simon\" <Simon.Chevalier@bnc.ca>"
      ],
      "status": "PARSE_DONE"
    },
    "see_name": "stamus-central-server",
    "dest_ip": "143.90.14.135",
    "event_type": "smtp",
    "agent": {
      "version": "7.16.1",
      "hostname": "SSProbe-1",
      "id": "9f305fa4-6db1-485c-81f9-598dce1469e3",
      "type": "filebeat",
      "ephemeral_id": "da6efa0f-f749-4bb3-8918-c3514cb604ff",
      "name": "SSProbe-1"
    },
    "in_iface": "tppdummy0",
    "flow_id": 1128546258990361
  },
  "fields": {
    "@timestamp": [
      "2022-09-11T18:54:29.495Z"
    ],
    "EveBox": [
      1128546258990361
    ],
    "timestamp": [
      "2022-09-11T18:54:29.495Z"
    ]
  },
  "sort": [
    1662922469495
  ]
}