Can I scan URLs received by email?

The first step is to configure a connector that monitors an email box (with the Email or Exchange integrations). When email starts coming into Google Security Operations SOAR, their content can be either parsed by the mapping feature or extracted by the Create Entity playbook action (if playbooks are attached to the incoming emails).
Once all URLs are extracted, they can be used in manual actions and in playbooks.