I'd like to modify Email.Monitor.Monitoring workflow to pull all emails, except replies to Tasks, and create an Incident (IM). I see the New Incident/New Ticket components and have been working through the Customization document.

I'd like to have a rule that pulls all emails into the SD and still maintains email responses to current Tasks/Incidents. Is there a wildcard I can use in "Constant Value"? Something like, if it contains IM-[*, pass to "Not a New Incident"? While anything else is a new incident?

As is, everything goes to an EM where the Service Manager reviews the new EM. I'm just trying to avoid this and create a new IM for everything except existing IM's.