Does not appear to be documented, but I am seeing it on emails. DIR seems to be set to either INB for inbound and OUT for outbound. Right now it shows up under Unknown fields.
Until we have some sort of documentation for it I'd only be guessing. I did work to make sure that unknown fields like that get rendered somewhere so analysts still have access to them
Does not appear to be documented, but I am seeing it on emails. DIR seems to be set to either INB for inbound and OUT for outbound. Right now it shows up under Unknown fields.