How to setup email parsing for Security Operations?Summary Description Security Operations framework has email parser feature which is useful to create records for Security Operations.This requires the following steps. Configure Email PropertiesSetup Email AccountsInbound ActionConfigure Email Parser How to configure Email Properties for Security Operations? Details about configuring email properties are documented in the follow link.Customer is expected to work with their email admin internally to setup email accounts for Security Operations. https://docs.servicenow.com/csh?topicname=create-email-properties.html&version=latest How to setup an Email Account for Security Operations? Once the email account is configured for Security Operations ServiceNOW admin can setup POP account to process/download emails configured for Security operation.If the connection is established successfully then POP reader job download emails from email server.Emails downloaded are stored in the sys_email table. Details about configuring email account is documented in the following link. https://docs.servicenow.com/search?q=Configure+an+email+account How are records created for SecOps Email Event Table? Notification engine process inbound actions defined for any target table."Record SecOps Email Events" is the OOB inbound action which feeds data for email parser.If the "Record SecOps Email Events" inbound action gets executed then data extracted from email ( From,To, Subject and Body ) is copied to sn_sec_cmn_email_event table. SecOps Email Parser Once the data is copied to sn_sec_cmn_email_event table NOW platform executes email parser configured and copies data to any target table."Process Security Email" business rule has the logic to run email parser. Details about email parsing feature for Security Operations is documented in the following link. https://docs.servicenow.com/search?q=Security+Operations+email+parsing Troubleshooting 1.Ensure POP connection is successful for Security Operations email addresses. 2.If connection is successful verify if email is processed by POP reader.Goto sys_email table and locate the email record.Check email log and verify if "Record SecOps Email Events" inbound is processed. 3.If "Record SecOps Email Events" inbound is processed then email is copied to sysevent_in_email_action table.Email parser code then parse the data and creates a record for Security Operations. Applicable Versions Istanbul and Higher release Additional Information Security Operations https://docs.servicenow.com/search?q=Security+Operations