Email Routing Rule: Forward email to servicenow to create an incident

[GreenCauliflowr]

Hello all,

Our users report phish emails which then go to a specific email address. How can we set up forwarding from that email address to servicenow to auto create incidents?

Thanks

[Martin Dewit]

I believe you can simply set up your phishing mailbox to forward to your ServiceNow instance's primary SMTP address. From there you'll need to setup the User Reported Phishing in SIR.

[SanjivMeher]

One suggestion is to use Phishing Request module if possible which works pretty nice. It is part of Security Incident.

And for the email, you need to set up a rerouting rule on the phishing mailbox which would redirect all email received to the service-now email address. Then the inbound email actions needs to be setup depending on which method you are using.