OK, so for this it sounds like you'll want to use pieces out of the Email Communication pack.
When using the SendEmailReply automation (instead of just send-mail), this includes a thread ID in the message. The PreprocessEmail script from the same pack is configured as a Pre-Process Rule will then look for this thread ID on new incoming emails and where it finds one, match it with an existing incident and update that incident with the new information.
In your case, it sounds like instead of (or as well as) updating the incident, you want to change the owner of the original incident or notify an analyst or something similar. You'd need to extend the PreprocessEmail script for this extra part.
Whereas in the default Email Communications pack use case the SendEmailReply command would be executed by an analyst using a layout/button, you'll want to run SendEmailReply from the playbook automatically.
... View more