Aggregate reports from zoho.com failing to process

[steve-daedilus]

Aggregate report data being sent by zoho.com is failing to parse with error (filename shortened):

ERROR:cli.py:560:Failed to parse /input/21062413zoho.com.xml.gz - Not a valid aggregate or forensic report

Differences from a working file:

• identifier only has header_from field.
• SPF auth result has scope field.
• Some spf auth results are reporting a scope of "helo" and no domain field.

My question - what is the format standard required?