I just thought I would add a little to this. After a couple of iterations I have this set to run as a rule fired script. It does require outlook to be open but for my application it works perfectly. This iteration uses the MSXML2 reference. It takes the XML file that comes from a Cisco MARS appliance and reformats the message with the included information in the body of the text. This was necessary for my auto-ticket generator to work. My support model uses a centralized ticketing system and not the system included on the MARS appliance. So here is the code I have with no guarantees if it helps then great. I wanted to give back since mvidas was so great in helping me get started.
Also I wanted to see if I could post using the vba tags
Sub CollapseXMLtoBody(Item As Outlook.MailItem)
Dim Atch As Attachment, vFF As Long, tStr As String, bStr As String, lnStr As String, tmpFile As String, xmlDoc As New DOMDocument, incID As IXMLDOMElement, x As IXMLDOMNode
Dim sNode As String, inl As IXMLDOMNodeList
If TypeName(Item) <> "MailItem" Then Exit Sub
If Item.Attachments.Count = 0 Then Exit Sub
With Item
tmpFile = "C:\xxxTEMPFILExxx.xml"
For Each Atch In .Attachments
If LCase(Right(Atch.FileName, 4)) = ".xml" Then
Atch.SaveAsFile tmpFile
vFF = FreeFile
Open tmpFile For Binary As #vFF
tStr = Space$(LOF(vFF))
Get #vFF, , tStr
Close #vFF
xmlDoc.async = False
If xmlDoc.loadXML(tStr) Then
Set incID = xmlDoc.documentElement
Rem This line updates the Subject line and deletes MEDIUM or LOW events
If incID.childNodes.Item(1).childNodes.Item(0).childNodes.Item(2).Text = "HIGH" Then
Item.Subject = incID.childNodes.Item(1).childNodes.Item(0).childNodes.Item(2).Text & " " & Item.Subject
Else
Item.Subject = Item.Subject & "PROCESSED"
Item.Delete
Exit Sub
End If
Rem This is the first line of the body text
bStr = bStr & "IncidentID:" & incID.childNodes.Item(1).childNodes.Item(0).Attributes(0).nodeValue & vbCrLf & vbCrLf
Rem This is the second line of the body text
bStr = bStr & "Hostname:" & incID.childNodes.Item(0).childNodes.Item(4).Text & vbCrLf & vbCrLf
Rem This is the rules area of the body text
Set inl = incID.getElementsByTagName("Rule")
For i = 0 To (inl.Length - 1)
bStr = bStr & "UniqueID:" & incID.childNodes.Item(0).childNodes.Item(4).Text & "-" & inl.Item(i).Attributes(0).nodeValue & vbCrLf & vbCrLf
bStr = bStr & "RuleID:" & inl.Item(i).Attributes(0).nodeValue & vbCrLf & vbCrLf
bStr = bStr & inl.Item(i).childNodes.Item(0).Text & vbCrLf
bStr = bStr & inl.Item(i).childNodes.Item(1).Text & vbCrLf & vbCrLf
Next
Rem This is the detail information section
Set inl = incID.getElementsByTagName("Session")
For i = 0 To (inl.Length - 1)
bStr = bStr & "Session:" & inl.Item(i).Attributes(0).nodeValue & vbTab
bStr = bStr & "Source:" & inl.Item(i).childNodes.Item(1).childNodes.Item(0).Attributes(0).nodeValue & "("
bStr = bStr & inl.Item(i).childNodes.Item(1).childNodes.Item(2).Text & ")" & vbTab
bStr = bStr & "Destination:" & inl.Item(i).childNodes.Item(1).childNodes.Item(1).Attributes(0).nodeValue & "("
bStr = bStr & inl.Item(i).childNodes.Item(1).childNodes.Item(3).Text & ")" & vbTab
bStr = bStr & "IP Protocol #:" & inl.Item(i).childNodes.Item(1).childNodes.Item(4).Text & vbCrLf
Next
bStr = bStr & vbCrLf & "StartTime:" & incID.childNodes.Item(1).childNodes.Item(0).childNodes.Item(0).Text & vbCrLf
bStr = bStr & "EndTime:" & incID.childNodes.Item(1).childNodes.Item(0).childNodes.Item(1).Text & vbCrLf & vbCrLf
Item.Body = bStr
Else
Item.Body = "XML DIDN'T WORK"
End If
Rem unremark the following line if the attachements should be deleted
Rem Atch.Delete
Kill tmpFile
Item.Save
End If
Next 'Atch
End With
End Sub