Hello, 

We started working on SOAR recently and as part of it I am working to automate our Phishing response process. I was able to connect the incoming emails connecting and setup a automatic rule to parse the email > incident using SOAR's out-of-box email parsing script. 

The issue is when someone forwards the email, the original email is coming as an attachment and when the out-of-box script parses, it is unable to flag the original email sender (potential hacker). 

Any insights are highly appreciated.