---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Security Operations email parsing

# Security Operations email
parsing {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Security Operations email parsing

Security Operations email parsing enables ServiceNow customers to automatically generate Security Operations records from emails sent by external detection systems such as malware detectors, vulnerability scanners, firewalls, and threat intelligence tools.
This integration streamlines the creation and updating of security incidents, vulnerabilities, observables, and related records, accelerating threat response and remediation.
Show full answer Show less  
Emails sent to designated Security Operations email addresses are captured and processed by email parsers that identify and extract relevant data to create or update records. Emails that do not match existing parsers are flagged as unmatched and can be reviewed and reprocessed to improve parsing accuracy.

## How Emails Are Parsed

* Each Security Operations plugin (e.g., Security Incident Response, Threat Intelligence, Vulnerability Response) defines an **emailto** property specifying the email address for receiving integration emails.
* Incoming emails are stored in an email events table and evaluated against configured email parsers.
* Matching emails trigger transform and duplication rules that determine whether to create new records, update existing ones, or create child records based on duplication criteria.
* Parsed emails are linked to the created or updated Security Operations records and flagged as matched.
* Non-matching emails appear in the Unmatched Emails list for review and potential reprocessing.
* Emails are retained for 30 days by default before deletion.
* Email parsing complements, but does not replace, platform inbound actions and has limitations such as not supporting indirect field updates (e.g., sysjournalfield entries).

## Handling Multiple Records in One Email

The email parser supports dividing a single email into multiple sections using a configurable **Record Separator**. This enables the system to extract and create multiple records from one email, such as separate security incidents for each affected system reported in a malware detection email.

* The separator divides the email into sections evaluated independently.
* Global data applicable to all records (e.g., malware hash, malware name) can be extracted from header/footer sections.
* Section-specific field transforms extract details unique to each record, such as system name, IP address, or status.
* Records are created only for sections containing section-specific data; header sections without unique data do not create records.

## Practical Use for ServiceNow Customers

* Configure Security Operations email addresses to receive alerts from external security tools.
* Create and customize email parsers and transforms to accurately extract data from received emails.
* Leverage duplication rules to control record creation and updates, avoiding redundancies.
* Review unmatched emails to refine parsers and ensure comprehensive coverage of incoming alerts.
* Utilize multi-record parsing to handle consolidated emails reporting multiple security findings efficiently.

## Related Actions

* Create and edit email parsers within Security Operations to tailor data extraction to your environment.
* Manage email event records and their transforms for accurate Security Operations record creation.  
Generate new Security Operations
records from external detection systems using Email Parsing. This
feature provides a method for integrating information from external tools such as malware
detection, vulnerability detection, firewalls, threat intelligence, and more.
How emails are parsed

Any system that can send an email, can create Security Operations records, for example,
security incidents, requests, vulnerable items, vulnerabilities, security incident
observables, attack methods, and more.

All Security Operations plugins (Security Incident Response, Threat Intelligence, and Vulnerability Response) have a property
(email_to) that defines the email address where external
integrations should send emails to, to be parsed by the email parsers. See Email ProcessingProperties for more information.

Email sent to any of the Security Operations email addresses is
stored in an email events table. These emails are processed to determine whether they match
any email parser.

Emails that have a match are flagged and the transform and duplication rules create or
update a Security Operations record.
The email is linked to that record and flagged as `matched`.

Emails that do not match are listed in Unmatched Emails as
a Security Operations record. They can
be reviewed to help build email parsers to handle these emails. A Reprocess action allows
you to run the unmatched email through the parsers again. The original email log is linked
to that record.  
The duplication rules for the email transform manage multiple emails relating to the same issue. These rules define what makes a duplicate record and can prevent duplicate records from being created. When a duplicate is detected, the rule specifies what action to take: no action (do not create a new record), create the new record as a child record of the existing record, or update the existing record. When updating the duplicate rule specifies which fields in the existing record are updated.  
Note:  
A Security Operations email parser works in conjunction with platform inbound actions and does not replace them. It does not support setting values on indirect fields for example, sys_journal_field entries.

By default, email events are deleted after 30 days.
Multiple records

External detection systems (malware detectors, vulnerability, and so on) can send emails
that report on multiple items at one time. The email parser supports separators within the
email.

For example, a malware detector could send you an email report about all systems within
your network infected by one particular malware with information about the malware first,
followed by a list of the systems affected.
Figure 1. Sample malicious email  
In this example, when the Record Separator is set within your Email Transform as =================, it splits the email into four sections that are evaluated separately. This creates a Security Incident for each of the three affected systems.  
Note:  
The header section is detected but does not have any affected systems so, it is used in all three records and does not create a fourth record.

Field Transforms pull in data from each section. If something in the
header or footer of the email applies to all records, such as Malware Hash, Malware Name,
and Type in this example, the field transform for them should set Search for value to a value that searches within the email body either At the start of a line in the email body or Anywhere in the email body.

Field Transforms must be set to search At the start of a line within the record section or Sec for data that is
defined within each section, such as System, IP address, or Status. The record section
options are only available when there is a record separator defined within the email
transform.

When parsing an email with a separator defined, records are only created for sections with
at least one piece of section-specific data.

In this example, three records are created, even though there are four sections defined.
The first section is a header, and it lacks anything specific to only one system. If any of
the fields within the first section were filled in (System, IP, or Status), then a record
would be created for that section, as well.
* **[Create email parsers in Security Operations](https://www.servicenow.com/docs/zHuGCxVQTloOZWNUCZYT~g)**   
  Email Parsing creates Security Operations records from your email for security, vulnerability, and observables to expedite threat response and remediation.
* **[Edit email records in Security Operations](https://www.servicenow.com/docs/w6z2DZtPNWdBSMNQ9pNLRQ)**   
  Edit transforms in your existing email event records.

**Related concepts**   

* [Security Operations enrichment data mapping](https://www.servicenow.com/docs/ZFYePI4C7qIvsRat12BBmg "Enrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records. Security Operations workflows use enrichment data maps and provide output data to security incidents.")
* [Security Operations field mapping](https://www.servicenow.com/docs/SMQ95noykjtdiNxUiX_9RA "Security Operations tables can be mapped to and from other tables, linking a security incident to a customer service case or a problem to other parts of the Security Operations system.")  
**Related tasks**   

* [Create email parsers in Security Operations](https://www.servicenow.com/docs/zHuGCxVQTloOZWNUCZYT~g "Email Parsing creates Security Operations records from your email for security, vulnerability, and observables to expedite threat response and remediation.")

*[\>]: and then