Yes, you can create incidents in XSOAR based on emails arriving to a dedicated inbox. You'll need a mail integration like Mail Listener or Gmail Single User to receive the emails. These are most commonly used for phishing reports, but there's nothing to stop you from using them for other purposes. You can have multiple instances of the same integration, so if you need multiple mailboxes for different purposes that's fine too.
You can use the classifier and mapper with regular expressions (or similar) to select the appropriate incident type and extract stored data from the email into fields. For this, bear in mind that this kind of extraction works best with highly structured mails (eg, mails created to a template).
Once the incident has been classified and mapped, it will automatically execute the associated playbook for the incident type (depending on incident type settings).
... View more