Topic
This article describes how Everbridge Suite records the Opened By field for incidents created by email ingestion, the relationship between the incident and the email ingestion template configuration, and how to identify email-ingestion–generated incidents in Incident History.
Description
Incidents in Everbridge Suite can be created in several ways, including manually launching an incident from a template, automated systems such as email ingestion creating incidents when monitored addresses receive messages, or other system integrations that generate alerts. If an automated source such as an email ingestion integration is configured without sufficient filters, it can create many incidents automatically.
For incidents launched through email ingestion, the platform’s current behavior is to mark the incident as Opened By the user account that last modified the email ingestion template. Engineering confirms that the incident is attributed to the last modifier of the email ingestion rather than the originating email address. This is the expected behavior.
At present, there is no configuration to have Opened By display the original sending email or to leave it blank. Based on the available information, there is no current configuration to make Opened By show the original email sender or be blank. Support has indicated this is how the system currently works.
The system uses the Last Modified By account as the reference to confirm that the email ingestion is configured by an active user and that the user’s role grants access to the groups selected in the incident template. If that account is inactive or lacks the necessary role permissions, the ingestion will fail to resolve contacts and notifications will not be sent.
The Incident History includes an Integration column to the left that displays the integration type and the name of the email ingestion template used to create the incident. The Incident History view can be used together with this Integration column to identify incidents generated by email ingestion templates. The Integration column lists the integration and the email ingestion template name for the incident and can be used to identify the source template that created the incident until the planned service-account behavior is implemented.
Incidents created by email ingestion therefore show:
Opened By: the user who last modified the email ingestion template.
Integration column: the integration type and the name of the email ingestion template used to create the incident.
To configure and maintain email ingestion integrations used to launch incidents, see the related guidance on how to set up email ingestion in Everbridge Suite: EBS: How to Set Up an Email Ingestion Integration in Everbridge Suite.