Going back to the original post, your email log contains a sys_id, which user is that?



Flaka Pira issue - Copy.png



Also, on your Incident created notification, does it contain watchlist under ?