def parse_receipt_event(self, event):
        """ Parse a single Receipt event
        Based on:
        - Act (action)
        - TlsVer (TLS version)
        - Virus (was there a virus in a mail)
        - SpamInfo (is mail a spam)
        :param event: event to be parsed (single line in log)
        :return: parsed event
        """
        action = event['Act'] if 'Act' in event else None
        tls_version = event['TlsVer'] if 'TlsVer' in event else None
        is_virus = True if 'Virus' in event else False
        is_spam = False if 'SpamInfo' not in event or event['SpamInfo'] == '[]' else True
        if is_virus:
            event_id = 'mail_receipt_virus'
        elif is_spam:
            event_id = 'mail_receipt_spam'
        elif action == 'Rej':
            event_id = 'mail_receipt_rejected'
        elif action == 'Ign':
            event_id = 'mail_receipt_ignored'
        elif action == 'Bnc':
            event_id = 'mail_receipt_bounced'
        elif tls_version is not None and tls_version.startswith('TLSv1'):
            event_id = 'mail_receipt_received'
        elif action == 'Acc' and (tls_version is None or
                                  not tls_version.startswith('TLSv1')):
            event_id = 'mail_receipt_received_notls'
        else:
            event_id = 'mail_receipt_other'
        category = 'mail_receipt'

        timestamp = self.date_helper.convert_from_mimecast_format(event['datetime'])
        event.update({'mimecastEventId': event_id, 'mimecastEventCategory': category, 'time_generated': timestamp})

        return event
 Parse a single Receipt event
        Based on:
        - Act (action)
        - TlsVer (TLS version)
        - Virus (was there a virus in a mail)
        - SpamInfo (is mail a spam)
        :param event: event to be parsed (single line in log)
        :return: parsed event
        
Solutions/MimecastSEG/Data Connectors/TransformData/siem_parser.py