- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-13-2025 04:47 AM
Should we need to use current.update() or current.insert in inbound email action script for creating new incident.
I am using the script below. Is this correct, or should I make any modifications to comply with best practices?
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-13-2025 04:56 AM
best to check OOB inbound action on incident table
you should use current.insert() to insert a new record
If my response helped please mark it correct and close the thread so that it benefits future readers.
Ankur
✨ Certified Technical Architect || ✨ 9x ServiceNow MVP || ✨ ServiceNow Community Leader
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-13-2025 05:48 AM
Hi @Kishor O ,
Thank you for marking my solution as helpful! The community now supports multi-solution acceptance, allowing you to accept multiple answers.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-13-2025 05:25 AM
hi @Kishor O
Hardcoded Values: You're hardcoding the short_description, assignment_group, and other fields. This is generally not recommended. Ideally, these should be configurable, perhaps from system properties or a configuration table.
current.update() vs. current.insert(): You're currently using current.insert(), which is the correct approach for creating a new incident. current.update() is used to modify an existing record.
Lack of Input Validation and Sanitization: The script directly uses values from the email body without any validation or sanitization. This is a significant security risk. Malicious content in the email could be injected into your incident, leading to potential issues like cross-site scripting (XSS) or data corruption.
Error Handling: The script lacks proper error handling. What happens if email.body_text is empty or doesn't contain the expected format? What if the caller lookup fails?
Logging: While you have gs.info(), more detailed logging (especially for debugging and auditing) would be beneficial.
Business Logic directly in Inbound Action: Embedding complex parsing logic directly within the inbound email action makes it harder to maintain and reuse. Consider moving parsing and processing logic to a Script Include.