Capture Email Importance and translate to Priority

[Eric Sletten]

Is there a way, and how would I capture the importance of an email and assign an alert priority to it.  

We've routed emails coming to a team mailing list to an OpsGenie email integration so that we capture when someone makes a request or reports an issue it's captured.  Working towards the goal of our OpsGenie alert queue being the holder of all "issues" we're working on.

If someone sends an email with the importance of "high" that's part of the incoming data  headers but I'd like to create an action filter based on that and don't see a way to do it.

This is an example of the incoming data - I want to filter on "IMPORTANCE": "high"

"_headers": {
"MESSAGE-ID": "<XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX>",
"ACCEPT-LANGUAGE": "en-US",
"IMPORTANCE": "high",
"DKIM-SIGNATURE": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=XXXX.com; h=from : to : subject :\r\n date : message-id : content-type : mime-version; s=PPS12042020;\r\n bh=byGU3yumHR5BXM6XEDfjF9EUFPfGOygeCeCeMVgRCZ0=;\r\n b=U3inql5+jFtPZBlnJRp8jvctNE3b4Qdte7OJet64xWj2edIwyM+rRsalu9YLZEhD+kOk\r\n PO641skAcY2Pt71x6sa5D2SbBdgSDu5xRfbm75nwYb9rXJinQ/qfvR9C2pc1AUbtydJp\r\n eyUWddokKxWdRApPklNJHzNKlx5df3fY0enMWiGVIyXLtn2Gj0pOwTt7qDIgzJ8/Cd0k\r\n hJpnbiQhPG6K7UbkLk7P1XU+Ev275oNFeK0ZjZQ5jMrGIndXC8kleEtjjskIgxJ15k3K\r\n m8WhivGNRkejGfYsdVdU9j6wQ+xoI6bcuSqH7DatxJQruZlzwItiJERz/euDXCn5fsNS xw== ",
"FROM": "\"XXXXXXX, XXXX X.\" <XXXXXXXXXXXXXXX@XXXX.com>",
"X-PRIORITY": "5",
"RECEIVED": "from XXXXXXXXXXXXXXXXXX.com ([xxx.xxx.8.117]) by\r\n xxxxxxxxxx.com ([xxx.xxx.8.117]) with mapi id\r\n 15.00.1497.015; Thu, 20 May 2021 10:04:00 -0500",
"DATE": "Thu, 20 May 2021 15:03:59 +0000",
"CONTENT-LANGUAGE": "en-US",
"X-MS-TNEF-CORRELATOR": "",
"THREAD-INDEX": "AddNiVyy+0llyWGSSMiIPssoIK9VPA==",
"X-MS-EXCHANGE-TRANSPORT-FROMENTITYHEADER": "Hosted",
"X-ORIGINATING-IP": "[xxx.xxx.x.x]",
"CONTENT-TYPE": "multipart/alternative;\r\n\tboundary=\"_000_15a35d6d79f3405fabe526244568b7a9EX13OWTSRV4feddomadfedi_\"",
"SUBJECT": "Message Test #3",
"TO": "xxxx@xxxx.opsgenie.net",
"THREAD-TOPIC": "Message Test #3",
"X-MS-HAS-ATTACH": "",
"MIME-VERSION": "1.0",
"X-TM-AS-GCONF": "00"
},

[Nick H · Accepted solution]

Hi @Eric Sletten ,

You should be able to use a dynamic field to extract that. I believe what you need is:

{{_headers.IMPORTANCE}}

I'd also assume that might be parsed somewhere in the email - so you could consider using string processing or regex to extract this / other pieces of data:

https://support.atlassian.com/opsgenie/docs/string-processing-methods-in-opsgenie-integrations/

https://support.atlassian.com/opsgenie/docs/regular-expressions-for-improved-alert-filtering/

Hope this helps! Let us know whether or not that works, if you run into other questions, etc.