modified indentation, move handle function from SIEMMessage.thrift