Skip to main content


This Script is part of the Email Communication Pack.#

This script checks incoming emails from the incident type. If the emails contain an 8-digit hash in the email subject, the script will add the email response to the existing incident in the War Room with the "email-thread" tag. If there is no 8-digit hash in the email subject, the preprocessing will open a new incident for this email.

Note: In order to avoid performance issues, incoming emails will be added to an existing incident as "email-thread" only if the incident was modified in the last 60 days. If you wish to extend this period, navigate to Settings->Advanced->Lists and add a new list with the name XSOAR - Email Communication Days To Query. In the Data field fill in a single number representing the number of days to query back, for example: 90.

The script is a part of the Email Communication pack. For more information, see the section about permissions here:

Script Data#

Script Typepython3
TagspreProcessing, email
Cortex XSOAR Version0.0.0


Argument NameDescription
attachmentsThe context path for attachments
filesThe context path for files


There are no outputs for this script.