Describe the change
Email scanner was using dynamic population of output using unspecified key:value pairs. While this allowed for more data to be extracted from email headers, it was providing inconsistent results making it more difficult to build confident detection. By specifying fields to be collected, users can now search for specific fields.

Describe testing procedures
Tested against 12+ .EML and other email files.

Sample output
ScanEmail

{
  "attachments": {
    "filenames": [
      "test.pdf"
    ],
    "hashes": [
      "ee6a929959c631f2b6bcad4bf105d822"
    ],
    "totalsize": 28890
  },
  "body": "Hello, Buenos Dias, Bonjour! J\r\n\r\n\r\nPlThis is a test email.\r\n\r\n\r\nBest Regards\r\nYour account manager\r\nTester\r\n",
  "date_utc": "2022-05-16T18:15:35.000Z",
  "elapsed": 0.088485,
  "from": "[email protected]",
  "message_id": "CAEE7zbM=tPmafFhJTHeZKLMEGw8+knLD=SJdr8kNe2JT18+U9g@mail.gmail.com",
  "received_domain": [
    "mx0a-0020ab02.test.com",
    "mail-vk1-f195.google.com"
  ],
  "received_ip": [
    "8.8.8.8"
  ],
  "subject": "Test Subject",
  "to": [
    "[email protected]"
  ],
  "total": {
    "attachments": 1,
    "extracted": 1
  }
}

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of and tested my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings