args:
- defaultValue: ${incident.attachment}
  description: Attachments.
  isArray: true
  name: attachments
- description: Files.
  name: files
- name: CreateIncidentUntaggedEmail
  description: Allow the creation of an email for which we can't find an existing incident.
  defaultValue: 'true'
- name: reputation_calc_async
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  description: Specify whether to calculate the reputation in an asynchronous way.
  defaultValue: 'false'
- name: timezone
  defaultValue: UTC
  description: Timezone used for email thread timestamps (must be a valid IANA timezone such as UTC, Europe/London, or America/New_York; defaults to UTC if not specified or invalid).
comment: |-
  Preprocessing script for email communication layout.
  This script checks if the incoming email contains an Incident ID to link the mail to an existing incident, and tags the email as "email-thread".
  This script runs with elevated permissions. 
  Cortex XSOAR recommends using the built-in RBAC functionality to limit access to only those users requiring access to this script.
  For more information about the preprocessing rules, refer to: https://demisto.developers.paloaltonetworks.com/docs/incidents/incident-pre-processing
commonfields:
  id: PreprocessEmail
  version: -1
enabled: true
name: PreprocessEmail
script: ''
subtype: python3
system: true
tags:
- email
- preProcessing
type: python
dockerimage: demisto/btfl-soup:1.0.1.10120494
runas: DBotRole
tests:
- No tests (auto formatted)
fromversion: 5.0.0
contentitemexportablefields:
  contentitemfields:
    fromServerVersion: ''
scripttarget: 0