Update/populate external ID based on string in e-mail body/comment + keeping attachments

Hi,

1. We've set up a notify rule for escalation of incidents to external service provider by way of assigning the incident to a dummy worker, which in turn e-mails the incident data to their service desk system. This works fine. However, there is no correlation between our incident IDs in AexHD and their Call IDs. So, we have to do some manual labor in order to keep track of their call ID number when an incident is returned/updated from their service desk.

What I would like to do is to "pick up" their call ID from e-mail and automatically update/populate the external ID field in the internal incident based on a static string in the e-mail body (i.e "Vendor ID: $NUM$) or "Comment".

Is this possible?

2. When incidents are escalated and forwarded to external service provider by way of notify rule, attachments are not forwarded. Is there a way to also forward relevant attachments? Users often provide screenshots etc which would be very useful for the service provider.