We developped a parser for the IronPort Product, which is really complex, not from the message format but from all the message tracing in the different processes of Ironport...
Ironport logs are made of multiple operations IDs (RID, ICID, SMTPID...) which make really hard to follow a message in all the control processes.
It seems that Mailflow Central can link all these IDs to generate a simple message log, and perhaps there must be a way to collect this typical message.
In my configuration there was no mailflow central so envision was used to report on mail activities, and now we generate graphical reports and tables on accepted messages vs rejected, and rejection details, accounting and virus detection alerts.
Hope this can help.
" Hopefully IronPort will be supported natively in the near future " do you know some secrets of the roadmap ?