Thank you for your feedback.
Form temporarily unavailable. Please try again or contact docfeedback@servicenow.com to submit your comments.

Return Email Details from Exchange workflow

Log in to subscribe to topics and get notified when content changes.

Return Email Details from Exchange workflow

The Security Incident Response - Return Email Details from Exchange workflow returns details from the threat emails found on the Exchange Server.

About this task

In the security incident, the Query Exchange button on the Exchange Search form triggers the workflow when the Query result is set to Return details.
Exchange search query example
Workflow process activities include:
  • Runs a script to fetch a search query from all associated active search criteria records to run on the Exchange Server using the Get Email Details from Exchange Server activity,
  • Creates an Exchange Search Results record as follows:
    Field Value
    Action Search.
    Result type Details.
    Email count N/A.
    Search query Query text string runs on the Exchange Server.
    Email date received Timestamp for when the email arrived.
    Email read status Read/Not Read.
    Recipient Full email address.
    Search date Timestamp for when the workflow ran.
    Message ID Email message ID from the Exchange Server. (Not displayed.)
  • Exchange search query results example
  • Log Message.
    Note: Any PowerShell script errors are recorded in the system logs.
Return Email Details from Exchange workflow diagram
Feedback