Edit email records in Security Operations

Add or create transforms in your existing email event records.

Before you begin

Role required: sn_sec_cmn.admin

Procedure

  1. Navigate to Security Operations > Email Parsing.
  2. Click the email parser to edit.
    The following message may appear above the read-only record:

    This record is in the Threat Intelligence application, but Security Incident is the current application. To edit this record, click here.

  3. Click here.
    You are taken to the editable form of the transform.
    Email parsing
  4. Edit fields as appropriate.
  5. To edit Field Transforms, click in the field and change as appropriate.
  6. Click Update.