Inbound Action Condition for non-users

[perkinsarm]

We have a few email addresses, e.g., help@mycompany.com that will be used to create Incidents. If a message is received from an email address matching a user (~700 total) an incident is created and in some cases routed to the proper support team

If a request comes from an unknown email address the message simply sits unprocessed in our ServiceNow inbox.

What I've noticed with these messages is that the sys_email.user field contains the address of the sender, but the sys_email.user_id is always empty.

I'm experimenting with an inbound action that would create an incident but can't seem to get the Inbound Action condition correct? We want to be aware of these. The potential for spam aside, we do have use cases where we need to respond.

My current condition is:
((email.user_id=='')&&(email.user!=''))

Also, in my logs I'm seeing

"Skipping 'Create Incident for non-ServiceNow user', User Guest with email guest@example.com is inactive"

There is nothing in the incoming email containing guest@example.com. How is ServiceNow picking that up?

Thanks,

Brad

[Pradeep Sharma]

Hi Bradley,

If the sender of an incoming email matches an existing user, the instance impersonates the matching user to complete any inbound email actions. If the sender does not match an existing user, the instance impersonates the Guest user to complete any inbound email actions. If the impersonated user is locked out, the inbound email action fails.

http://wiki.servicenow.com/?title=Inbound_Email_Actions#gsc.tab=0

[perkinsarm]

Thanks Pradeep,   Are their known issues with activating the guest user?

[Pradeep Sharma]

I recommend disabling it. There are some esoteric   places in the system that use the guest account. You obviously don't want people to login with that account, but you don't want to lose reference to the account itself. Set the active field to false and perhaps even set Locked out to true, just for good measure.

Reference :

Should a guest account be disabled or deleted?

[perkinsarm]

Thanks for that article.

If I disable it then there would not be a way to respond to the external requests where we might need to bring the requester into ServiceNow.

I have already assigned the account a very long cryptic password.

One downside of enabling it is that the guest user becomes selectable/assignable within the app (I now recall that is why we originally disabled it) although we may have to live with that.

With that said, do you know the correct condition for detecting that the email was from the guest user?