Email message operations

To access the email message operations, the selected Object Type for the script must be Email Message.

Type emailmessage. in the script line to see the available operations, which are described in the following table.

Operation Description
Returns an array of attachment metadata objects, with each element containing the following properties:
  • id
  • presented_filename
  • presented_content_type
  • suggested_filename
  • suggested_content_type
  • content_id
  • size
  • inline

The "presented_" prefix properties (which may have a value of None) reflect the file details as defined by the email headers.

The "suggested_" prefix properties (which always have a value) reflect the file details as calculated upon inspection by the email ingester.

The inline property indicates whether the attachment was found inline in the email body (True) or a separate file attachment (False).

The attachment metadata objects are not visible in the script editor type ahead.


Returns the content of the email body as plain text. Any HTML markup is removed.


Returns an array of objects representing the recipients present in the CC or To field of the email. Each element defines a mandatory address value with an optional name value.


Returns a single object representing the recipient in the From field of the email. This object defines a mandatory address value with an optional name value.


Returns the content of the email message, including the HTML markup. The returned string is a unicode string.


Returns a map (dictionary) representation of the headers defined in the email. The header name acts as the map key and the corresponding value for each header key is an array that may contain none, one or multiple elements. Both the header name and the elements in the corresponding array of header values are all expressed as strings.


Returns the ID number assigned to the email message, which is shown on the Mail Inbox page.


Returns the name of the inbound email connection configured in the Orchestration & Automation application. You can view the inbound mailboxes in the Organization tab under Administrator Settings.


Returns the date the email message was received.


Returns the date the email message was sent.


Returns the subject of the email message.


Associates the email message with the incident specified by helper.findIncidents(). It does not return a value, but sets the top-level incident variable.

createAssociatedIncident(name, owner_handle)

Creates an incident based on the email message. It does not return a value, but sets the top-level incident variable.

Use name to provide a name for the incident.

Use owner_handle to specify a reference to the owner of the new incident. For an individual user, enter the user's ID or email address. For a group, enter the group's ID or name.

You can also use incident.owner_id to assign the incident to a user or group.

The following python 3 script example adds all header information as a note on the associated incident:
headers = ""
for header in emailmessage.headers:
    headers += "\n'" + header + "': ["
    for i, value in enumerate(emailmessage.headers[header]):
        if i > 0:
            headers += ", "
        headers += "'{}'".format(value)
    headers += "]"
incident.addNote("=== EMAIL HEADERS ===" + headers)

For an example of using Email Message, see Associating email messages with incidents.