Skip to content
IT Canvass
How-to Guides · Lesson

Create an inbound email action

Quick answer

A worked example: create incidents from a monitoring mailbox and update them on reply.

Key takeaways

  • Condition on the sender so the action is narrow
  • Truncate the subject before writing to short description
  • Test with real messages from the source system
  • Pair a New action with a Reply action

Plan the behaviour

Decide the target table, the condition that identifies these messages, and what happens on reply. For a monitoring mailbox: create an incident when the sender matches the monitoring system, and add a comment when a reply arrives.

Build the action

Create an inbound action of type New on the incident table with a condition on the sender, then set fields in the script.

// New action, condition: email.origemail == 'alerts@monitoring.example'
current.caller_id = gs.getProperty('acme.monitoring.caller');
current.short_description = email.subject.substr(0, 160);
current.description = email.body_text;
current.category = 'network';
current.impact = 2;
current.urgency = 2;
current.insert();

Test it properly

Send a real message from the monitoring system, not a hand typed one.

  • Confirm the record was created with the fields you expect
  • Reply to the notification and confirm the comment lands on the same record
  • Check the email log for Received-ignored entries that show conditions not matching
  • Add a Reply action so updates append rather than creating a second incident

Want to learn this properly?

Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.

Check your understanding

  1. Which action type handles the first message in a thread?

    • A. New
    • B. Reply
    • C. Forward
    • D. Ignore
    Show answer

    A. New

    New runs when there is no watermark linking to an existing record.

  2. Where do you confirm the condition did not match?

    • A. Transaction log
    • B. Email log Received-ignored entries
    • C. ACL log
    • D. Slow query log
    Show answer

    B. Email log Received-ignored entries

    Ignored entries record that no action matched the message.

Frequently asked questions

How do I avoid duplicate incidents from repeated alerts?

Search for an open incident with the same correlation id or short description in the script and update it instead of inserting.

Can I attach the original email?

Yes, attachments are copied automatically when the action creates the record, and the source email is always linked in sys_email.
CallWhatsAppEnquire