[MODEL:dataset="barracuda_email_protection_raw"]
alter 
    payload = arrayindex(regextract(_raw_log, "\[\d\]: (\{.*?$)"), 0)
| alter
    xdm.target.domain = payload -> dst_domain,
    xdm.target.user.username = payload -> hdr_to,
    xdm.target.identity.username = payload -> hdr_to,
    xdm.email.sender = arrayindex(regextract(payload -> hdr_from, "\<(.*?)\>"), 0),
    xdm.email.subject = payload -> subject,
    xdm.email.message_id = payload -> message_id,
    xdm.email.delivery_timestamp = parse_timestamp("%Y-%m-%dT%H:%M:%S%z", payload -> timestamp),
    xdm.email.recipients = arraymap(payload -> recipients[], "@element" -> email),
    xdm.source.sent_bytes = to_integer(payload -> size),
    xdm.source.ipv4 = payload -> src_ip,
    xdm.source.user.username = arrayindex(regextract(payload -> hdr_from, "\"([^\"]+)\""), 0),
    xdm.source.identity.username = arrayindex(regextract(payload -> hdr_from, "\"([^\"]+)\""), 0),
    xdm.event.description = to_string(payload -> recipients[]);