--- title: "Using Automated Email Ingest Knowledge Base Article | ThreatConnect" slug: "using-automated-email-ingest" description: " This article describes how to set up Phishing and Feed mailboxes for automated ingestion of Indicators and phishing emails into ThreatConnect." tags: ["Orchestration and Automation", "Importing Data"] updated: 2024-03-21T14:33:16Z published: 2024-03-21T14:33:16Z canonical: "knowledge.threatconnect.com/using-automated-email-ingest" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Using Automated Email Ingest ## Overview In addition to supporting manual importing of .**eml** and .**msg** files, ThreatConnect® allows you to set up phishing and feed****mailboxes for automated ingestion of both Indicators and phishing emails. ThreatConnect will search for Indicators, automatically import them, and then associate these Indicators to an [Email Group](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model#group-types) corresponding to the imported email. ImportantAn Organization Administrator must create the [phishing](https://knowledge.threatconnect.com/docs/creating-a-phishing-mailbox) and feed mailboxes before you can use them. ## Before You Start | Minimum Role(s) | Organization role of Standard User | | --- | --- | | Prerequisites | An .**eml** or .**msg** file | ## Feed Mailbox 1. Copy the email address of the mailbox to be used.ImportantThis email address will need to be created and supplied beforehand by an Organization Administrator. If you do not know the mailbox’s email address, contact an Organization Administrator. A System Administrator can rename the mailbox’s email address if desired (e.g., to make it more user friendly). 2. Create a new email message in your email provider. 3. Paste the email address in the **To:** field, and enter the Indicators you want ThreatConnect to ingest in the body of the email (Figure 1). ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/using-automated-email-ingest-image-ezzkaox5.png) 4. Once all information is entered, send the email.ImportantRemove any email signatures so that any email addresses or hostnames in the signature are not accidentally added as Indicators in ThreatConnect. 5. If desired, you can navigate to [the **Browse** screen](https://knowledge.threatconnect.com/docs/the-browse-screen) to verify that the Indicators have been added to your Organization. ## Phishing Mailbox 1. Copy the email address of the mailbox to be used.ImportantThis email address will need to be created and supplied beforehand by an Organization Administrator. If you do not know the mailbox’s email address, contact an Organization Administrator. A System Administrator can rename the mailbox’s email address if desired (e.g., to make it more user friendly). 2. Create a new email message in your email provider. 3. Paste the email address in the **To:** field, enter what you want to be the Email Group's name (**Summary**) in ThreatConnect as the subject line of the email, and add a phishing email as an **.eml** attachment (Figure 2). ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/using-automated-email-ingest-image-s6q0wiyi.png) 4. Once all information is entered, send the email. 5. [Navigate to the **Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen#viewing-the-details-screen) for the new Email Group (Figure 3). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/using-automated-email-ingest-image-m0tarkuj.png) 6. Click the **UPDATE ANALYSIS** button. The **Import** tab of the **Import E-mail** screen will be displayed (Figure 4). This screen displays the contents of the email and its header. ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/using-automated-email-ingest-image-imujuiq7.png) 7. Click the **Next**button. The **Score** screen will be displayed (Figure 5). This screen displays a breakdown of how the total **Score** for the phishing email was calculated based on the email scoring rules configured on the **E-mail Scoring**tab of the **System Settings**screen. See the “Email-Scoring Rules” section of *ThreatConnect System Administration Guide*for more information. ![Graphical user interface, application, Teams Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/using-automated-email-ingest-image-7c4lyioe.png) 8. Click the **Next** button. The **Indicators** screen will be displayed (Figure 6). ![Graphical user interface, text, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/using-automated-email-ingest-image-r1bjxngs.png) 9. To add Indicators highlighted in the email header and body into ThreatConnect, hover over them and click the **ADD INDICATOR** button that is displayed, as demonstrated for the **72.255.12.30** Address Indicator in Figure 6. Indicators that are added will be displayed under the **NEW** heading on the **Indicator List**card (Figure 7).ImportantIndicators found in the email will be associated to the Email Group only if they exist in the Organization, Community, or Source to which the phishing mailbox belongs.![Graphical user interface, text, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/using-automated-email-ingest-image-7y0ftxay.png) 10. Click the **Next** button. The **Confirm** screen will be displayed (Figure 8). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/using-automated-email-ingest-image-c2thtjmj.png) 11. Verify the data, and then click the **SAVE**button. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20045-01 v.07.C ## Related - [Creating a Phishing Mailbox](/creating-a-phishing-mailbox.md) - [Creating an HTTP Feed](/creating-an-http-feed.md) - [Email Import](/email-import.md) - [Structured Indicator Import](/structured-indicator-import.md) - [Unstructured Indicator Import](/unstructured-indicator-import.md)