--- title: "Email Import Knowledge Base Article | ThreatConnect" slug: "email-import" description: "This article discusses how to import an email (e.g., a malicious or suspicious email) into ThreatConnect as an Email Group and select Indicators from the email to associate to the Email Group and, optionally, to Victims." tags: ["Getting Started", "Importing Data"] updated: 2024-03-15T21:54:27Z published: 2024-03-15T21:54:27Z canonical: "knowledge.threatconnect.com/email-import" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Email Import ## Overview A malicious or suspicious email can be imported into ThreatConnect® as an [Email Group](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#group-types). ThreatConnect will search for [Indicators](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#indicator-types), allow you to select which Indicators to import, and then associate these Indicators to the Email Group. Optionally, these same Indicators can be associated to one or more Victims. Once the Email Group is created, you can view the original email, email headers, and all associated Indicators. ## Before You Start | Minimum Role(s) | Organization role of Standard User | | --- | --- | | Prerequisites | An .eml or .msg file | ## Importing an Email 1. On the top navigation bar, hover the cursor over **Import** and select **E-mail**. The **Import E-mail** screen will be displayed (Figure 1). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/email-import-image-fpagygky.png) 2. Click the **+ IMPORT MSG OR EML FILE** button to select an .msg or .eml file stored on your computer to import into ThreatConnect. After the file is selected, the contents of the email, including the recipient, sender, subject, body, and headers, will be displayed on the **Import E-mail**screen (Figure 2). ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/email-import-image-ijghfr3u.png) - **Owner**: Select the Organization, Community, or Source into which the email will be imported as an Email Group. - **Include Shared Data In Analysis**: Select this checkbox to include crowd analytics, if available. When this feature is enabled, the email will be rated based on Indicators from your connections and Communities, as well as Indicators from within the email. When Indicators are evaluated within the email, your own Indicator ratings will be analyzed first to determine the score of the email. If there are no Indicators, the average ratings of those Indicators across your connections and Communities will be evaluated.NoteWhen importing an email into an Organization, the data will be pulled from the Organization as well as the Communities and Sources to which the Organization has access. When importing an email into a Community or Source, this checkbox will not be displayed, as only data from that Community or Source are used to evaluate and score the email. - Click the **Next** button. 3. The **Score** screen will be displayed (Figure 3). ![Graphical user interface, text, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/email-import-image-xqby0mbh.png) - **Score Total**: This card displays the Threat Score of the email, which can range from 0 to 1000. If the email is being imported into an Organization and the **Include Shared Data In Analysis**checkbox was selected in the previous screen, this score is based on the findings in other Organizations, Communities, and Sources. If the email is being imported into a Community or Source, or if it is being imported into an Organization and the **Include Shared Data in Analysis**checkbox was not selected in the previous screen, this score is based only on the findings within the owner into which the email is being imported. - **Score**: This****card explains the rules used to calculate the **Score Total**.NotePrivate Instance users should contact their System Administrator for details on the email scoring rules configured for their ThreatConnect instance. - Click the **Next** button. 4. The **Indicators** screen will be displayed (Figure 4). This screen displays all Indicators found in the header and body of the email. ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/email-import-image-e3ip9kmt.png) - Switch between the **Header** and **Body** sections by using the dropdown menu at the top left of the screen. - In the **Indicators**card on the left, select desired Indicators to import by hovering the cursor over the Indicator and clicking the **ADD INDICATOR**button that is displayed (Figure 5). ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/email-import-image-vvdzm3yb.png) - In the **Indicator List**card on the right, Indicators that already exist in the target Organization, Community, or Source will be listed in the **Existing** section as a hyperlink. Clicking on an Indicator in this section will display its [**Details** screen](/v1/docs/the-details-screen). - Any Indicator added from the **Indicators**card on the left will be listed in the **New** section of the **Indicator List**card. - Indicators that are part of an [Indicator Exclusion List](/v1/docs/creating-indicator-exclusion-lists) will be listed in the **Excluded** section of the **Indicator List**card, along with a brief summary of the exclusion rule they fall under. - Click the **Next** button. 5. The **Victims** screen will be displayed (Figure 6). ![Graphical user interface, application, website Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/email-import-image-jackikja.png) - To associate the email with a Victim, select or add Victims from the **Victims** card on the left and click the **ADD**button. Next, drag the Victim’s email address from the **Unassigned Email Addresses** card on the right to the **Victims** card to associate it to the Victim. - Click the **Next** button. 6. The **Confirm** screen will be displayed (Figure 7). ![Graphical user interface, text, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/email-import-image-u3ia20od.png) - Review this screen and ensure you have captured all desired information from the email. - Click the **SAVE** button to complete the import process. 7. The **Details** screen for the new Email Group will be displayed (Figure 8), showing all properties of the email, including the **Body**, **Header**, and **Score Breakdown**. ![Graphical user interface, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/email-import-image-5es2q00o.png) --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20007-01 v.08.C ## Related - [Signature Import](/signature-import.md) - [Structured Indicator Import](/structured-indicator-import.md) - [The Details Screen](/the-details-screen.md) - [Unstructured Indicator Import](/unstructured-indicator-import.md) - [Using Automated Email Ingest](/using-automated-email-ingest.md)