Skip to main content

PreprocessEmail

This script checks incoming emails from the incident type. If the emails contain an 8-digit hash in the email subject, the script will add the email response to the existing incident in the War Room with the "email-thread" tag. If there is no 8-digit hash in the email subject, the preprocessing will open a new incident for this email.

Note: In order to avoid performance issues, incoming emails will be added to an existing incident as "email-thread" only if the incident was modified in the last 60 days. If you wish to extend this period, navigate to Settings->Advanced->Lists and add a new list with the name XSOAR - Email Communication Days To Query. In the Data field fill in a single number representing the number of days to query back, for example: 90.

The script is a part of the Email Communication pack.

For more information about the preprocessing rules, please refer to https://xsoar.pan.dev/docs/incidents/incident-pre-processing.

Script Data#


NameDescription
Script Typepython3
TagspreProcessing, email
Cortex XSOAR Version0.0.0

Inputs#


Argument NameDescription
attachmentsThe context path for attachments
filesThe context path for files

Outputs#


There are no outputs for this script.