View and reprocess unmatched Security Operations emails

task brazil Updated Sep 10, 2026 1 min read viewing-reprocessing-unmatched-emails.md

You can review Unmatched Emails for discontinued filters or as candidates for a new filter to maintain or improve the rate at which you catch email threats.

Before you begin

Role required: sn_sec_cmn.read

Procedure

Navigate to All > Security Operations > Unmatched Emails.

If any unmatched emails have been found, they are listed.

The fields on the form are as follows:

Field	Description
From	Email address of the sender.
To	Email address of the recipients.
Subject	Subject line in the email.
Body	Contents of the body of the email.
Matched	Indicates if this email event was matched.

To reprocess this email, create an email record or edit an existing email record to match the information in this email.

See Create email parsers in Security Operations.
Navigate back to Security Operations > Unmatched Emails.
Click Reprocess Email Event to attempt to process this email.

It returns you to the Unmatched Emails main list. If the new email record matches, the email event is no longer in the list. A message indicates if it was matched or not.

Parent Topic:Unmatched Security Operations email events

50 lines · 2.1 KB Wrap lines

---
title: View and reprocess unmatched Security Operations emails
description: You can review Unmatched Emails for discontinued filters or as candidates for a new filter to maintain or improve the rate at which you catch email threats.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/viewing-reprocessing-unmatched-emails.html
release: brazil
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Unmatched Security Operations email events, Security Operations email processing, Security Operations common functionality, Security Operations]
---

# View and reprocess unmatched Security Operations emails

You can review Unmatched Emails for discontinued filters or as candidates for a new filter to maintain or improve the rate at which you catch email threats.

## Before you begin

Role required: sn\_sec\_cmn.read

## Procedure

1.  Navigate to **All** &gt; **Security Operations** &gt; **Unmatched Emails**.

    If any unmatched emails have been found, they are listed.

2.  The fields on the form are as follows:

    |Field|Description|
    |-----|-----------|
    |From|Email address of the sender.|
    |To|Email address of the recipients.|
    |Subject|Subject line in the email.|
    |Body|Contents of the body of the email.|
    |Matched|Indicates if this email event was matched.|

3.  To reprocess this email, create an email record or edit an existing email record to match the information in this email.

    See [Create email parsers in Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/parsing-emails.md).

4.  Navigate back to **Security Operations** &gt; **Unmatched Emails**.

5.  Click **Reprocess Email Event** to attempt to process this email.

    It returns you to the Unmatched Emails main list. If the new email record matches, the email event is no longer in the list. A message indicates if it was matched or not.


**Parent Topic:**[Unmatched Security Operations email events](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/umatched-emails.md)