Hello folks,
I’m a newbie and almost know nothing about coding 
I was playing with the Parser Extension and bummer, none of it working 
Is anyone here can shed some light to write me a working Parser Extension based on “Office 365” prebuilt parser with the sample RAW log as below?
My objective is to map the "AttachmentDetails" which include the labels, Name and Size to the additional fields or any relevant fields that fit:
{
"CreationTime": "2025-01-30T13:44:55",
"ExchangeMetaData": {
"AttachmentDetails":
{
"Labels":
"aaaaaaa-bbbb-ccc-dddd-eeeeeeeeeeee"
],
"Name": "TestFile1.xlsx",
"Size": 45682
},
{
"Labels": ],
"Name": "Burger.pdf",
"Size": 555555
},
{
"Labels": 
,
"Name": "picture.jpg",
"Size": 120456
},
{
"Labels": "
"aaaaaaa-bbbb-ccc-dddd-eeeeeeeeeeee"
],
"Name": "List.csv",
"Size": 12345
}
],
"BCC": ],
"CC": -],
"FileSize": 200000,
"From": "ABC@sample.com",
"IsViewableByExternalUsers": true,
"MessageID": "\u007bABCDEFG1234567@ABCDEFG.GBRP512.PROD.OUTLOOK.COM\u007a",
"RecipientCount": 1,
"SensitivityLabelIds": o
"1234567-1234-1234-1234-123456789aaa",
"aaaaaaa-bbbb-ccc-dddd-eeeeeeeeeeee"
],
"SensitivityLabelNames": C
"Galaxy Movie",
"Shared"
],
"Sent": "2025-01-30T13:44:00",
"Subject": "Test Email",
"To":
],
"UniqueID": "7654321-1234-1234-1234-123456789aaa"
},
"Id": "abcdefg-1234-1234-1234-123456789aaa",
"IncidentId": "gfedcba-1234-1234-1234-123456789aaa",
"ObjectId": "\u007bABCDEFG1234567@ABCDEFG.GBRP512.PROD.OUTLOOK.COM\u007a",
"Operation": "MipLabel",
"OrganizationId": "zzzzzzzz-1234-1234-1234-123456789aaa",
"PolicyDetails": :
{
"PolicyId": "00000000-0000-0000-0000-000000000000",
"Rules": e
{
"Actions": F],
"ConditionsMatched": {
"ConditionMatchedInNewScheme": true,
"OtherConditions": 8
{
"Name": "SensitivityLabels",
"Value": "Internal"
}
]
},
"RuleId": "1234567-1234-1234-1234-123456789aaa",
"RuleMode": "Enable",
"RuleName": "Galaxy Movie",
"Severity": "Low"
}
]
}
],
"RecordType": 13,
"SensitiveInfoDetectionIsIncluded": false,
"UserId": "ABC@sample.com",
"UserKey": "keyskeys-1234-1234-1234-123456789aaa",
"UserType": 0,
"Version": 1,
"Workload": "Exchange"
}
