This project never got past the testing phase before the testing team pivoted off of emails and worked on direct connections with ServiceNow.  So we never implemented it.  However, I was able to dig through my old notes, and locate the Script we had created for the Inbound Email Action that did this.  

Here is what that code looks like:

(function() {
    // Email body text
    var emailBodyText = email.body_text;
    
    // Extract relevant section of the email body
    var startKeyword = "Days Left";  //header of last column name before the start of the first row of data
    var endKeyword = "This article";  //first words after the last row of data
    var extractedText = extractTextBetweenKeywords(emailBodyText, startKeyword, endKeyword);
    
    // Parse the extracted text and create incidents
    createIncidentsFromText(extractedText);
    
    function extractTextBetweenKeywords(text, startKeyword, endKeyword) {
        var startIndex = text.indexOf(startKeyword);
        var endIndex = text.indexOf(endKeyword);
        
        if (startIndex === -1 || endIndex === -1 || startIndex >= endIndex) {
            gs.error("Invalid start or end keyword in the email body");
            return "";
        }
        
        // Extract and return the text between the keywords
        return text.substring(startIndex + startKeyword.length, endIndex).trim();
    }

    function createIncidentsFromText(text) {
        var lines = text.split(/\r?\n/);
        
        for (var i = 0; i < lines.length; i += 3) {
            if (i + 2 < lines.length) {
                var siteName = lines[i].trim();
                var expirationDate = lines[i + 1].trim();
                var daysLeft = lines[i + 2].trim(); // daysLeft is not used but can be logged or used as needed
                
                // Create a new incident record
                var incident = new GlideRecord('incident');
                incident.initialize();
                incident.submitter = email.from;  
                incident.caller_id = email.from;  
                incident.category = "Network";
                incident.subcategory = "Configuration";
                incident.incident_state = 1;
                incident.impact = '4';
                incident.urgency = '3';
                incident.priority = '3';
                incident.contact_type = "email";
                incident.assignment_group.setDisplayValue("Network");
                incident.short_description = 'Expiration Warning - ' + siteName;
                incident.description = 'Site Name: ' + siteName + '\nExpiration Date: ' + expirationDate;
                incident.insert();
                
                //gs.info('Created incident for Site Name: ' + siteName + ' with Expiration Date: ' + expirationDate);
            }
        }
    }
})();