The EmailUserReportedPhishing script include processes inbound emails and creates a record in which table?

The EmailUserReportedPhishing script include is a core component of the User Reported Phishing feature within ServiceNow Security Incident Response. When a user forwards a suspicious email to a designated mailbox, the EmailUserReportedPhishing inbound action triggers this script. The script's primary function is to parse the forwarded email and create a new record in the User Reported Phishing Submissions table. The technical name for this table is snsiphishingemail. This record acts as the initial submission, which can then be analyzed, and if deemed malicious, escalated into a full security incident (snsiincident).

A. arsnsiphishingemail: The ar prefix typically denotes an archive table in ServiceNow, which is used for long-term storage of inactive records, not for creating new ones.
B. snsiincident: This is the main Security Incident table. While a phishing submission can be promoted to a security incident, the initial record is not created here.
C. snsiphishingemailheader: This table stores parsed email header data associated with a phishing submission, but it is not the primary table for the submission itself.

1. ServiceNow Product Documentation: In the "User Reported Phishing" feature overview

the process is explicitly described: "The User Reported Phishing inbound email action processes the email and creates a record in the User Reported Phishing Submission [snsiphishingemail] table."

Source: ServiceNow Product Documentation

"User Reported Phishing

" Washington DC Release.

2. ServiceNow Product Documentation: The configuration guide for the inbound action confirms the target table: "When an email is received by the inbound action

a record is created in the User Reported Phishing Submissions [snsiphishingemail] table."

Source: ServiceNow Product Documentation

"Configure the User Reported Phishing inbound email action

" Washington DC Release.

3. ServiceNow Developer Documentation: The table schema confirms the purpose of the snsiphishingemail table.

Source: ServiceNow Developer Site

Table name: snsiphishingemail

Label: "User Reported Phishing Submission".