From 013baff3e3f02e20f446d528f2afdcd25ba63fcf Mon Sep 17 00:00:00 2001
From: mits <104266846+mitalizope@users.noreply.github.com>
Date: Mon, 20 Oct 2025 00:09:47 +0530
Subject: [PATCH 1/2] Create create_incident_from_case_email.js

Inbound action to create incident from case reply email and link it as a parent with inherited caller & CI.
---
 .../create_incident_from_case_email.js        | 46 +++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 Server-Side Components/Inbound Actions/Auto Incident Creation from Case Email/create_incident_from_case_email.js

diff --git a/Server-Side Components/Inbound Actions/Auto Incident Creation from Case Email/create_incident_from_case_email.js b/Server-Side Components/Inbound Actions/Auto Incident Creation from Case Email/create_incident_from_case_email.js
new file mode 100644
index 0000000000..374b390b7d
--- /dev/null
+++ b/Server-Side Components/Inbound Actions/Auto Incident Creation from Case Email/create_incident_from_case_email.js	
@@ -0,0 +1,46 @@
+(function runAction(/*GlideRecord*/ current, /*GlideRecord*/ event, /*EmailWrapper*/ email, /*ScopedEmailLogger*/ logger, /*EmailClassifier*/ classifier) {
+
+	//Extract email subject and body
+	var subject = email.subject.toLowerCase();
+	var body = email.body_text.toLowerCase();
+
+	//Define trigger keywords for creating the incident
+	var keywords = ['outage', 'crash', 'down', 'error', 'issue', 'not working', 'failure', 'slow'];
+	var trigger = false;
+
+	for(var i = 0; i < keywords.length; i++){
+		if(subject.includes(keywords[i]) || body.includes(keywords[i])){
+			trigger = true;
+			break;
+		}
+	}
+
+	//Execute only if trigger word found
+	if(trigger){
+		//Create a new incident record
+		var inc = new GlideRecord('incident');
+		inc.initialize();
+		inc.short_description = 'Auto-created from Case ' + current.number + ': ' + email.subject;
+		inc.description = 'Customer reported via Case ' + current.number + ':\n' + email.body_text;
+		inc.parent = current.sys_id;
+
+		//Link caller and CI from case to incident if available
+		if(current.contact)
+			inc.caller_id = current.contact;
+		if(current.cmdb_ci)
+			inc.cmdb_ci = current.cmdb_ci;
+
+		var incSysId = inc.insert();
+
+		//Update case work notes
+		current.work_notes = 'Incident ' + inc.number + ' created automatically from customer email.';
+		current.update();
+
+		//Add incident work notes
+		var newInc = new GlideRecord('incident');
+		if(newInc.get(incSysId)){
+			newInc.work_notes = 'Auto-created from Case ' + current.number + '.\n\nEmail Content:\n' + email.body_text;
+			newInc.update();
+		}
+	}
+})(current, event, email, logger, classifier);

From b3aaedf5ae251f04aa07d238a314292f04e30b5d Mon Sep 17 00:00:00 2001
From: mits <104266846+mitalizope@users.noreply.github.com>
Date: Mon, 20 Oct 2025 00:13:49 +0530
Subject: [PATCH 2/2] Create README.md

---
 .../README.md                                 | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 Server-Side Components/Inbound Actions/Auto Incident Creation from Case Email/README.md

diff --git a/Server-Side Components/Inbound Actions/Auto Incident Creation from Case Email/README.md b/Server-Side Components/Inbound Actions/Auto Incident Creation from Case Email/README.md
new file mode 100644
index 0000000000..796d3ad198
--- /dev/null
+++ b/Server-Side Components/Inbound Actions/Auto Incident Creation from Case Email/README.md	
@@ -0,0 +1,21 @@
+**Auto Incident Creation from Case Email** 
+
+**Description** 
+This inbound email action automatically creates an incident record when a customer replies to a case email containing keywords like outage, crash, error, or not working. 
+The new incident links to the case as a parent and inherits caller and configuration item details. 
+
+**Use Case** 
+Ideal for CSM environments integrated with ITSM, where customer issues escalate to incidents automatically. 
+
+**How It Works**
+1. The inbound email action scans the subject and body for trigger keywords.
+2. If a match is found:
+   - A new incident record is created.
+   - The incident is linked to the case as a parent.
+   - Caller and CI are inherited if available.
+   - Work notes of both case and incident records are updated. 
+
+**Inbound Action Configuration**
+   - Table: Case[sn_customerservice_case]
+   - Action type: Record Action
+   - Type: Reply