How-to Guides · LessonBy Praveen T, ServiceNow Trainer, 9 yrs · Published · ServiceNow · all levels
Create an inbound email action
A worked example: create incidents from a monitoring mailbox and update them on reply.
Quick answer
A worked example: create incidents from a monitoring mailbox and update them on reply.
Key takeaways
- Condition on the sender so the action is narrow
- Truncate the subject before writing to short description
- Test with real messages from the source system
- Pair a New action with a Reply action
Plan the behaviour
Decide the target table, the condition that identifies these messages, and what happens on reply. For a monitoring mailbox: create an incident when the sender matches the monitoring system, and add a comment when a reply arrives.
Build the action
Create an inbound action of type New on the incident table with a condition on the sender, then set fields in the script.
// New action, condition: email.origemail == 'alerts@monitoring.example'
current.caller_id = gs.getProperty('acme.monitoring.caller');
current.short_description = email.subject.substr(0, 160);
current.description = email.body_text;
current.category = 'network';
current.impact = 2;
current.urgency = 2;
current.insert();Test it properly
Send a real message from the monitoring system, not a hand typed one.
- Confirm the record was created with the fields you expect
- Reply to the notification and confirm the comment lands on the same record
- Check the email log for Received-ignored entries that show conditions not matching
- Add a Reply action so updates append rather than creating a second incident
Practice challenge
+0 XPStreak ×0
Question 1 of 2
Which action type handles the first message in a thread?
Frequently asked questions
How do I avoid duplicate incidents from repeated alerts?
Search for an open incident with the same correlation id or short description in the script and update it instead of inserting.
Can I attach the original email?
Yes, attachments are copied automatically when the action creates the record, and the source email is always linked in sys_email.