{
    "@timestamp": "2026-10-08T21:20:37Z",
    "event": {
        "module": "exchange",
        "dataset": "smtp",
        "category": "email",
        "kind": "metric"
    },
    "observer": {
        "type": "mail_server",
        "product": "Microsoft Exchange Server",
        "vendor": "Microsoft"
    },
    "health_score": {
        "score": 100,
        "status": "EXCELLENT",
        "color": "#16a34a",
        "deductions": []
    },
    "threats_count": 0,
    "threats": [],
    "metrics": {
        "files_processed": 1,
        "file_names": [
            "demo"
        ],
        "total_sessions": 16,
        "unique_ips": 15,
        "unique_users": 3,
        "connectors": 4,
        "total_messages": 10,
        "total_bytes": 54042120,
        "total_rcpt": 16,
        "total_errors": 10,
        "tls_sessions": 9,
        "tls_pct": 56.3,
        "authenticated_sessions": 4,
        "anonymous_sessions": 11,
        "failed_auth_sessions": 1,
        "earliest": "2026-08-18T00:15:10.000Z",
        "latest": "2026-08-18T22:15:00.000Z",
        "sessions_truncated": 0,
        "detail_sessions_kept": 16
    }
}