You start with the Flag byte. A Group Broadcast message type has the Group number in the 3rd byte of the To: address. A Group Cleanup Direct message type has the Group number in the cmd2 field. A Direct message type content of cmd2 is command dependent. Generally not a Group number in Direct commands unless you are keeping track of Insteon commands that manage Insteon device links. For device control, such as turning on a device with a Direct command, cmd1 would contain a 0x11 and cmd2 would contain the Bright level, up to a 0xFF which is 100% Bright.
Over the years much of the basic Insteon message content has found its way into the public domain. On the SmartLabs site there is a public domain document, “Insteon Details”, which can be downloaded. Page 18 of that document has the best description of the Flag byte I have seen in a public document. Smartlabs does not publish a comprehensive list of commands and their content. You can purchase a Developer SDK membership from Smartlabs for about $200 but you have to sign a NDA.