Event Management

Access ITOM Configuration Console to set up Event Management and configure AIOps capabilities.

Access the IT Operations Management configuration console to set up Event Management and configure AIOps capabilities.

Acknowledge alerts that you’ve viewed to remove clutter in the Express List pane.

Add the CMDB tables that contain application services to be considered during impact calculation, helping ensure accurate and relevant impact results.

Specify the application services that must be considered during impact calculation to ensure accurate service impact assessment.

Enable the system property that switches on statistics processing for events to let the platform collect and analyze metrics such as event volume, processing flow, and handling time. This helps you monitor system performance, identify bottlenecks, and optimize event handling for faster and more efficient operations.

Set the time period, in seconds, for collecting event processing statistics. For example, you can set a time period twice as long as the default 60 seconds to collect more statistics.

Create different views of alerts by adding tags in Express List to enable you to easily identify and group alerts without the need for discovery or accessing the CMDB.

Add any relevant alert discovered during the review of an automated alert group as a secondary alert to improve the group's completeness and utility for incident troubleshooting.

Add a CMDB group CI relationship for a CI class to enable accurate alert group generation.

Connect the agent to the MID Web Server to enable configuring mTLS on your MID Web Server and agent.

The ITOM Configuration console gives administrators a single place to complete all Event Management setup steps — from installing plugins to configuring alert automations.

Placing an alert into the Acknowledged state indicates that the alert has issues that need to be addressed.

Initiate an alert analysis from the ServiceNow Otto panel. The alert analysis displays directly in the panel for convenient review.

Alert assignment groups assign alerts to the right teams promptly and automatically, improving overall incident management capabilities.

Define alert clustering conditions to trigger one or more alert clustering tags, which help create alert groups from fewer alerts. Creating alert groups from fewer alerts reduces noise, making it easier to identify critical incidents, prioritize responses, and manage issues effectively.

A list of the predefined alert clustering definitions provided with the Tag Based Alert Clustering Engine  application.

Activate the predefined alert clustering definitions provided with the Tag-Based Alert Clustering Engine application before use. Utilizing these preconfigured definitions minimizes setup time and ensures a more efficient configuration process, allowing for quicker implementation and streamlined alert management.

A list of the predefined alert clustering tags provided with the Tag Based Alert Clustering Engine  application.

Get started faster with alert clustering by attaching a predefined alert clustering tag to a tag-based alert clustering definition in Event Management. By associating a predefined tag, you ensure that alerts meeting the specified criteria are grouped effectively, facilitating quicker identification and response to related incidents.

Tag cluster alert grouping enables you to easily create groups of alerts. It is a non-code method of alert grouping that correlates alerts without having to use CMDB or model training. This simpler way of grouping similar alerts reduces the overall noise of a large quantity of alerts.

Create streamlined alert correlations with alert clustering tags by grouping alerts that share identical or similar tags based on your configured match method. This reduces noise, enhances incident prioritization, and improves operational efficiency, enabling faster issue resolution and response times.

Manage the fields that define how alerts are correlated and grouped.

Alert execution information provides a reference to the actions that have been performed concerning the alert. Among the information presented is which alert management rules ran on the alert, incidents that were opened, and which remediation workflows ran.

The fields to be configured on the Respond page, when selecting an action to be triggered by an alert automation.

Reduce noise by locating only aggregated alert groups that match a configured filter. Aggregated groups are groups created for alerts with identical CIs and pattern identifiers.

Filter alerts and alert groups to reduce alert noise. Only alerts that match the filter are included in the group of the selected group type (Automated, CMDB, or Text).

Enable swift resolution by generating cases from alerts, either manually or automatically.

View an alert group analysis created using generative AI. The analysis offers a simplified, human-readable description of the alert group and technical information to help you investigate it more efficiently.

Use AI to generate a meaningful description of an alert group in Express List that encompasses all the alerts within the group. The generated description replaces the original description of the group.

Save the human-readable summary generated by ServiceNow Otto in the Alert analysis as the description of an alert group.

Alert grouping methods range from user-defined approaches, like Manual and Rule-based to advanced, fine-tunable algorithms, including Automatic, Mixed, Text-based, Log Analytics, and Network Traffic-based grouping.

Explore different alert grouping types, understand their descriptions, and learn about their creation methods to enhance problem identification and streamline alert management.

Automate alert organization by configuring jobs to group alerts based on predefined criteria and parameters.

Alert insight aids faster alert triage, enabling a quicker way to find a solution and expose the probable root cause of the selected alert.

Placing an alert into the Maintenance state indicates that there are issues with the alert's CIs that are being addressed.

You can configure Event Management to respond to alerts automatically. An alert management rule determines the required alert response, such as to open an incident, knowledge base article, open a task, launch remediation action.

For better triage and focus, alerts that have a higher priority are brought to the top of the alert list. This placement brings to your attention those alerts that require you to handle them at a higher priority than other alerts.

Determine the order in which to handle alerts according to the alert priority score. Multiple factors determine the alert priority score and this value changes with changes to the underlying factors.

You can combine similar alerts that meet specific criteria for a particular service by creating an alert query.

Alert executions information provides a reference to the alert management rule actions that are performed. This information appears in the Alert Management Rule record only if an alert matches the filter in the rule and an action was performed. You can click any link in the Alert Executions list to open the referenced item.

Finding alerts that are similar to the alert that you are currently investigating can help save troubleshooting time by seeing how similar alerts were resolved.

View an alert analysis created using generative AI. Alert analysis include a human-readable brief of the alert and technical information to help you investigate the alert more effectively.

View an alert analysis by ServiceNow Otto for an alert on the alert's Overview tab in the Service Operations Workspace. Alert analyses include a human-readable brief of the alert and technical information to help you investigate the alert more effectively.

View an alert analysis created using generative AI. Alert analyses include a human-readable brief of the alert and technical information to help you investigate the alert more effectively.

Alert tags consolidate normalized alert fields (key/value) across sources, improving alert quality for correlation and expanding out-of-the-box TBAC (Tag Based Automatic Correlation) definitions.

The Apache Kafka Consumer connector creates events from messages collected from the Apache Kafka topic as a JSON payload in a data block.

An application service is a set of interconnected applications and hosts which are configured to offer a service to the organization.

In an alert, use the Quick Response feature to apply remediation to the alert or to launch a web application.

Assign the evt_aiops_manager role to the group that is responsible for managing NOC operators and AIOps AI specialists.

Assign the evt_mgmt_operator role to groups to enable operations teams to work with alerts and manage Event Management workflows.

Assign the evt_mgmt_admin role to users who will be in charge of configuration and operational control.

Assign alerts in Express List to yourself, to someone else, or to an assignment group to balance your organization's work load.

Assign individual users and user groups to preconfigured Express List views to make sure that they focus on specific services, priorities, or alerts.

Assign alert assignment group precedence to make sure that alerts are routed to the appropriate team members.

Learn how to assign and manage alerts in Express List.

Scheduled jobs automatically close alerts in the Alerts [em_alert] table that meet specific conditions, reducing alert noise.

Integrate Amazon Web Services (AWS) with Event Management. To add AWS platform as a data source, configuration is required in the AWS platform.

Integrate Microsoft Azure with Event Management by authenticating Azure V1 or V2 tokens in the Azure Monitor.

Integrate Microsoft Azure with Event Management by adding a standard webhook in Azure Monitor.

Integrate Microsoft Azure with Event Management by adding the Azure Monitor as an authenticated data source.

An Azure Issue is a unified case that aggregates related alerts and signals from Azure Monitor into a single, trackable operational problem. It preserves investigation context and serves as a durable record for incident management Incident Management, so you can resolve problems faster instead of tracking scattered alerts.

Bind alerts to specific applications on hosts using event rules. This ensures accurate tracking and faster issue resolution by linking alerts to the correct resources.

Use event field mapping to dynamically bind alerts to the appropriate CIs based on event attributes. This eliminates the need for separate event rules for each CI type, also known as CI class.

Binding alerts to Configuration Items (CIs) using the Node field or the CI Identifier field ensures accurate event association. By comparing an event record’s Node or CI Identifier value, alerts are linked to the right system. This improves response, root cause analysis, and impact assessment by providing clear visibility into affected assets.

Run response actions to efficiently remediate and respond to issues on multiple alerts directly from the Express List pane.

ServiceNow Event Management is a robust application that helps keep your IT systems healthy by spotting problems quickly and fixing them. It collects events from different sources, figures out what's causing the issues, and converts them into alerts. These alerts are then analyzed, grouped, and acted upon to resolve issues and maintain system health.

An alert is a notification for selected events that are considered to be important and require attention. Event Management generates alerts based on event rules.

Event Management provides various modules, templates, and properties for configuring alerts and the actions that execute for these alerts.

After activating Event Management, set it up to receive and process events, and generate and analyze alerts.

An event is a notification from one or more monitoring tools that indicate something of interest has occurred, such as a log message, warning, or error.

Rule-based alert grouping is created by alert correlation rules. These rules allow you to manually classify alerts as primary or secondary and establish a relationship between them. Use alert correlation rules to group related alerts. The rule runs only for new alerts or alerts whose status changed from close/flapping to open/reopen.

Use Event field mappings rules to map values from specific fields to values in other fields.

Event identifiers uniquely distinguish one event from another. Event Management uses these identifiers to determine whether to create a new alert or update an existing one.

When a CI is in maintenance, the impact tree, the service map, and Alerts tab are updated based on various factors.

Impact calculation shows the magnitude of an outage on CIs, services, alerts, and alert groups. The system uses factors such as impact rules and CI relationships to calculate the severity of a generated alert. The severity appears on the impact tree, application services maps, and dashboards.

Event Management requires all events to use a standard form, regardless of how they arrive at the instance.

Event Management supports the creation of SLAs for application services and for CIs.

For SNMP traps, the MID Server requires failover configuration for the trap listener.

Automated alert grouping is a process that uses historical data to automatically organize similar alerts into groups. These alerts could be system issues, like server errors or network outages. By grouping related alerts together, it helps teams quickly identify patterns, manage recurring problems, and reduce the noise from too many individual alerts.

The Learned Patterns report helps assess the efficiency of alert aggregation and identify recurring alert patterns. It enables proactive issue resolution, enhancing overall system performance by providing insights into frequent alerts.

Alert grouping is the process of organizing and consolidating related alerts into sets based on common characteristics or criteria. This helps in simplifying alert management by reducing noise, making it easier to prioritize, track, and address issues efficiently. Grouped alerts provide a clearer overview of related incidents, facilitating quicker root cause analysis and remediation.

Integrate Catchpoint with Event Management by adding an alert webhook in the Catchpoint platform.

CI binding or linking is the process of finding and connecting a Configuration Item (CI) from the Configuration Management Database (CMDB) to an alert, using the logic defined in event rules. This helps ensure alerts are tied to the right IT components for better visibility and faster issue resolution.

Learn the process of binding Configuration Items (CIs) to alerts. This includes handling event arrival, binding alerts using available fields when no node is present, and searching the CMDB for matching hosts. It also explains linking alerts to CIs based on host and CI type detection.

Bind each alert directly to the originating device to establish a clear source of impact. This ensures accurate troubleshooting, reduces noise from unrelated alerts, and helps teams focus on resolving the right issue faster.

When CI Field Matching is used and the CI is a host, the Node value from the alert is used for binding. The system compares the Node with attributes like Name, FQDN, IP, or MAC Address in the CMDB to find a match. This ensures that alerts are correctly linked to the corresponding host CI.

If no match is found using the Node field, the system uses the CI identifier field to match alerts with non-host CIs based on attributes like Name, FQDN, IP, or MAC. This ensures accurate alert association, improving visibility, troubleshooting, and root cause analysis for diverse infrastructure components.

Bind CIs by matching event Additional information fields with CI attributes. If column names differ, manually create an additional key-value pair to align with the CI table, ensuring accurate CI association.

Alert and configuration item (CI) remediations help troubleshoot and resolve underlying problems that generate alerts. Remediation is based on Orchestration workflows that can be scripted to perform remediation tasks such as gathering system information or rebooting a server.

Schedule jobs to mark and remove old alert records in the Alert History [em_alert_history] and Impact Status [em_impact_status] tables, to prevent the tables from becoming overloaded with data.

Manually close alerts from the Express List pane or preview panel if you know the root cause or have fixed the problem.

Learn about the key properties and functionality of CMDB alert grouping, which facilitate efficient alert organization based on relationships and enhance the overall effectiveness of alert management.

Use cases for CMDB grouping enhance alert management by correlating alerts based on Configuration Item relationships, improving visibility, and facilitating more efficient troubleshooting.

CMDB based alert grouping helps organizations manage alerts by organizing them according to their related configuration items (CIs) within the Configuration Management Database (CMDB). This method groups alerts based on CI relations in applications or infrastructure components. Teams can better understand the impact of issues, respond more effectively to alerts, and maintain service availability.

Activate the event forwarding job to periodically send events to all target instances with active event forwarding configurations.

Configure a Datadog work item to aggregate related alerts and signals from Datadog into a trackable operational problem.

Configure the Alert Aggregation Learner (Service Analytics Alert Aggregation Learner - Daily), an offline job that runs daily to process past alerts. It identifies patterns of related alerts using a combination of pattern-based and probabilistic techniques, enabling quicker detection and resolution of recurring issues.

Improve alert management by enabling users to customize correlation logic order. This feature empowers you to fine-tune correlation methods to their specific needs, enhancing alert prioritization and response efficiency.

Use these properties to configure alert insight.

Run commands to perform alert remediation on remote Linux and Windows CIs.

The Azure Monitor Pull connector sends information from ServiceNow Event Management to the Azure Portal. The pull connector sends the alert state changes from the ServiceNow environment to the Azure Portal.

Integrate ServiceNow Cloud Observability with Event Management by adding a standard webhook in the ServiceNow Cloud Observability platform. Download the Event Management Connector plugin from the ServiceNow Store so you can integrate with ServiceNow Cloud Observability.

Use the Contextual colors and icons form to configure color, text, and icons to have different default or custom contexts, identified by a context ID.

Configure the Dynatrace connector instance to receive Metric Intelligence raw data from the Dynatrace server.

Configure the MID WebService Event Collector Context to provide a URL method to push event messages from an external source to the MID Server.

Create an event forwarding configuration record to enable events to flow from one ServiceNow instance to another instance. Forwarding events to multiple target instances requires creating separate configuration records for each target instance.

Configure the Icinga 2 (Icinga) connector instance to receive events while monitoring your network resources.

Configure the Apache Kafka Consumer connector instance to create events from streaming messages collected by the Apache Kafka connector.

Configure the Kafka metric consumer connector instance to read message send to Kafka server over topic.

Integrate with a push connector to connect to an external event source. Push connectors process the collected event messages and transform them to the required event format.

The Logicmonitor pull connector sends information from Event Management to Logicmonitor. It sends responses received from a Push connector in a bi-directional environment to Logicmonitor.

Configure an alert management rule to operate the manage alerts autonomously agentic workflow manually or automatically.

Provide redundancy capabilities of an entire cluster in case of failure of one or more CIs in that cluster. By viewing the relative impact of a cluster member on the cluster information, you can better understand the source of alerts and take remediation steps.

Provide added security to your MID Web Server extension by using key-based authentication. Generate an authentication token to be sent in the Authorization header of incoming client requests.

Enhance security in your MID Web Server extension by enabling mTLS authentication.

The MID Web Server is a MID Server extension that enables developing REST APIs to send events and metrics to the MID Server. The extension is leveraged by other MID Server extensions, such as Metric Intelligence, MID WebService Event Listener, and the Agent Client Collector websocket endpoint extension.

The MID Server supports the collection of event messages using the MID Web Server to collect data from external sources. The data is transformed (parsed) to the format required for event fields in the event [em_event] table and transmitted to the instance.

Fields in the form for creating or modifying a MID Web Server extension.

Configure a TLS listener for extra security and encryption of data transferred to and from the MID Web Server extension. Access a private key and certificate (or certificate chain) from a Java keystore. The keystore is used during the TLS handshake where the MID Web Server and the client acknowledge each other.

Configure the NagiosXI connector instance to receive events from the Nagios Core monitor.

Configure the Nagios metric connector instance to receive Metric Intelligence raw data from the Nagios server.

Configure the HP Network Node Manager i (NNMi) connector instance to receive events while monitoring your network resources.

Configure the Operation Bridge Manager (OBM), also known as OMi v2, connector instance to receive alerts from the OBM server. The OBM connector script OBM v2 will be available after installing the Event Management Connectors app.

Configure the HP Operations Manager (OMi) connector instance to receive alerts from the HP OMi server.

Configure the OP5 or OP5_v2 Monitor connector instance to receive alerts from an OP5 Monitor source.

Configure the Opsview_V2 connector instance to receive alerts from an Opsview Monitor source.

Configure the PRTG connector instance to receive alerts from a Paessler PRTG Network Monitor source.

Configure a push connector instance to receive the events from an external system.

Configure SAP to forward alerts to the BADI (Business Add-in) you create for the integration.

Configure SAP solution manager to retrieve alerts in the system by enabling the alert inbox with the SOA manager.

As part of enabling communication with Event Management, you must create a Remote Function Call (RFC) in the SAP Solution Manager and install a transport.

Configure the SAP Solution Manager (Solman) connector instance to enable communication between the SAP Solution Manager and Event Management.

Configure the SNMP trap listener to receive traps from Oracle Enterprise Manager (OEM).

By default, most SNMP trap events are processed by a single Event Management processing job. This can negatively effect event processing. Configure message keys on the MID Server to ensure that more than one processing job is invoked, ensuring optimal SNMP trap performance.

Configure the SolarWinds connector instance to receive Metric Intelligence raw data from the SolarWinds server.

You can configure a self-health monitor to track Event Management components and see that they do not exceed the specified threshold.

Configure the VMware vCenter Server (vCenter or vCenter_V2) connector instance to receive events from your VMware vSphere environment.

Configure the Zabbix Metric connector instance to receive Metric Intelligence raw data from the Zabbix server.

Override push connector default domain metadata values installed with Event Management with the values in the event HTTP request, including the URL, headers, request body (payload), and connector parameters. Override pull connector domain metadata values with connector parameters only.

Event Management provides many connectors to pull or push events from external devices. Connectors are available from the ServiceNow store as well as from third parties. You can also create custom connectors.

You can use a JavaScript API to convert existing manual services to application services. Event Management can use application services to monitor service performance and identify health issues.

Synchronize alert response with grouping by ensuring alert management jobs runs after alert grouping jobs—this prevents duplicate actions like incident creation on secondary alerts.

Create an alert management rule to track alerts and resolve them by determining the required response, for example, to open an incident or launch remediation action.

You can manually create an application services. Event Management can use application services to monitor service performance and identify health issues.

Create credentials to access a ServiceNow instance.

Create credentials to access Nagios XI server.

Create a Basic Auth credential in ServiceNow to store the SolarWinds user name and password that the SolarWinds monitor connector uses to access the SolarWinds API.

Create credentials to access vRealize.

Create credentials to access Zabbix server.

You can create a subflow according to your requirements. For example, you can resolve alerts, notify teams, or run remediation actions.

Use event rules to generate alerts for tracking and remediation. Event rules are stored in the Event Rule [em_match_rule] table. Configure and customize event rules to manage events and alert generation.

Ignore automation streamlines the process of disregarding irrelevant or false-positive alerts from monitoring systems, efficiently managing alert fatigue by filtering out unnecessary notifications. As a result, teams can prioritize and resolve critical issues more effectively.

Create an incident with a human-readable, AI-generated description from the Express List pane by using AI.

Configure automation rules to automatically create incidents from alerts that require immediate attention and resolution.

Create a dedicated account with the evt_mgmt_integration role for third-party monitoring systems to push events to ServiceNow.

Create keys and certificates in your root directory to enable Transport Layer Security (TLS) setup. TLS setup is required before you can configure mTLS on the MID Web Server and agent.

Use maintenance rules to mark CIs in maintenance status. When in maintenance status, these CIs are excluded from impact calculation.

You can create event rules to generate alerts for tracking and remediation. Use team-based integrations in event rules to make sure that connector ownership and execution of rules give precedence to general rules. Teams can maintain consistency and hierarchy while offering flexibility and customization options.

Some connectors have no parameters that are shipped out of the box. Therefore, it’s necessary to create and add the parameter to the push connector configurations list in the form layout before adding the new parameter.

Create service groups to combine similar services. Organize services by groups to perform actions simultaneously on multiple services and to control user access to services.

Create and train a solution that applies machine learning to a collection of words to target and suggest similar alerts in your instance dataset. For example, you can compare the text in a resolved alert record to an open alert record to reuse its resolution approach.

In the map view of an application service, the severity of a child service is propagated to its parent service.

You can create a self-health monitor to use custom health monitor script to monitor specified Event Management components.

Integrate Datadog with Event Management by adding a standard webhook in the Datadog console.

Integrate Datadog with Event Management by adding a standard webhook in the Datadog console.

Integrate Datadog with Event Management by authenticating Datadog V1 or V2 tokens in the Datadog Monitor.

Configure delay rules to postpone incident creation for alerts that may resolve automatically or represent transient conditions.

Delete an automation to permanently remove an automated alert handling rule from your system.

Delete a CMDB group CI relationship to limit available relationships for CMDB alert grouping, helping to reduce noise and improve alert relevance.

The Dependency map illustrates how and why alerts are grouped, simplifying troubleshooting and issue management. It reveals connections between CIs within a CMDB alert group, enhancing visibility into their relationships. Additionally, if a CI is not part of the group but connects to other alert CIs, it remains visible on the map, aiding alert resolution and proactive management.

Disable network traffic-based alert grouping to prevent alerts from being grouped solely by network activity. This reduces noise during traffic spikes and helps critical issues stand out for quicker resolution.

Use domain separation to enable self-health to display Event Management health issues that are based on data, rules, and settings from the logged in user domain. The selected domain must not contain any child domains.

Create events in different domains for all Event Management connectors using just a single connector instance by personalizing domain separation of Event Management connectors.

Domain separation is supported in Event Management. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

The Dynatrace connector instance form displays the fields you must fill in when creating a Dynatrace connector instance.

The following table displays the Dynatrace connector instance value parameters that you can fill in, as needed, when creating a Dynatrace connector instance.

Integrate Dynatrace with Event Management by adding Dynatrace as an authenticated data source.

Integrate Dynatrace with Event Management by adding a standard webhook in the Dynatrace console.

Integrate Dynatrace with Event Management by authenticating Dynatrace V1 or V2 tokens in the Dynatrace Monitor.

Add columns to the Event Management Express List display to focus the list of alerts that is displayed or modify the existing columns that are displayed.

Fields in the dialog box for editing a Performance Analytics dashboard widget.

Use the push connector that allows events to be forwarded from products, generally from IBM, that support the Event Integration (EIF) format to a MID Server.

If the EIF event payload has a warning severity, it will be mapped differently in the ServiceNow instance.

View an alert group analysis created using generative AI. The analysis offers a simplified, human-readable description of the alert group and technical information to help you investigate it more efficiently.

View an analysis of alert groups in Express List, generated using AI. The analysis helps you better understand the nature of the alert group, why the alerts in the group were correlated, and how to proceed in the remediation process.

Update alert descriptions in alert groups or single alerts in Express List, to a human-readable summary generated by AI.

View the connections between alerts in alert groups in Express List that were created based on the proximity of Configuration Items (CIs) in the Configuration Management Database (CMDB). Link View shows how the attributes of the alerts in the group are linked with each other.

Create an incident with a human-readable, AI-generated description.

Perform a text search for alert records in a filtered list of alerts.

Choose whether to display the closed alerts in an alert group as well as the open alerts on the preview panel and in Link View.

Learn how to apply color-coded highlights to alerts in the Express List based on conditions such as severity, state, and priority, so you can quickly spot critical signals.

View extra information on the preview panel about impacted services that are bound to alerts.

Use keyboard shortcuts to quickly perform common actions in the Express List.

Gain a better understanding of the relationships between alerts in alert groups in the Express List by using Link View. Link View offers a visual representation of the relationships between the alerts in a group.

View the connections between alerts in network traffic-based alert groups in Express List by using Link View. Network traffic-based alert groups are created by analyzing network traffic connections between processes across hosts.

Remove secondary alerts from an alert group directly from the Express List pane or from the preview panel.

View the connections between alerts in a rules-based alert group in Express List by using Link View. Link View shows how the attributes of the alerts in the group are linked with each other.

Visualize the chronological sequence of events within an alert group in Express List using the Timeline view. This feature provides a comprehensive overview of when the alerts occurred, their severity changes, and other pertinent data for efficient triage and Mean Time to Resolution (MTTR).

Gain insight into the sequence of events relating to an issue by viewing chronological information of the alerts in an alert group in Express List.

Event Management architecture integrates data collection, processing, and alerting into a unified system for streamlined IT issue detection and resolution.

You can collaborate with colleagues and write work notes while working in an alert.

Determine what the Event Management - Insert Health Monitor scheduled job is to monitor. After the job runs, you can view the ServiceNow Event Management application services.

Event Management collects, analyzes, and converts events into alerts, enabling efficient tracking and remediation.

Set up rules and parameters to group related alerts automatically, streamlining alert management and reducing alert noise.

Activate network traffic-based alert grouping to automatically correlate and reduce alert noise by grouping related events based on network traffic patterns. This helps improve efficiency in alert response and streamlines alert management.

Before configuring mTLS authentication on the agent, you must run a series of commands that enable configuring Transport Layer Security (TLS) authentication.

Alert enrichment involves transforming raw events from monitoring tools into a standard format, aiding automated grouping and response. This includes extracting fields from lengthy alert payloads or composing them into a standardized format. Additionally, you can create tags, which are metadata added to alerts for easier filtering and grouping.

Configure alert enrichment rules to automatically add context and metadata to incoming alerts for better analysis and response.

Explains how Event Management alert automation preprocesses values before applying regex patterns. Describes why matching behavior differs between pre-populated Additional Info JSON fields and free-text sample values.

The MID WebService Event Collector enables you to collect JSON formatted event messages sent from BMC TrueSight Operations Management (TrueSight), previously known as BMC ProactiveNet Performance Management (BPPM). It uses event stream notification capabilities.

The MID WebService Event Collector enables you to collect event information from custom payloads in JSON, XML, or plain text format.

The MID WebService Event Collector enables you to collect JSON formatted event messages sent from Google Cloud Platform (GCP).

The MID WebService Event Collector enables you to collect JSON formatted event messages from the Logicmonitor.

The MID WebServer Event Collector enables you to collect JSON formatted event messages sent from the Microsoft Azure portal.

Create credentials in the instance and configure the ThousandEyes webhook.

Configure the MID WebService Event Collector to provide a URL method to push event messages to the MID Server.

Platform Analytics Solutions contain preconfigured dashboards. These dashboards contain actionable data visualizations that help you improve your business processes and practices.

Accelerate the event processing testing life cycle by forwarding a stream of events from your ServiceNow production environment to your non-production environment.

Several system properties enable you to customize an event forwarding job.

The Event Input pane that is included in the steps to create an event rule provides a reference to the information that you can use when configuring an event rule.

Reference topics provide additional information about mapping and fine-tuning application services using Event Management lists and forms.

Table rotation is used by Event Management, by default, to contain the growth of event [em_event] tables within the rotation table group.

Exclude CI-based or CI class-based alerts and patterns when you encounter alerts incorrectly added to a learned pattern by the Learned Patterns job. For example, a pattern might include an alert that occurred at the same time as other alerts but is not actually related to them. This maintains accuracy, ensuring better alert groupings and improved management efficiency.

ServiceNow Otto for ITOM provides generative AI skills and agentic workflows in Express List that help operators triage alerts, investigate incidents, and respond faster.

Explore Event Management to understand its overview, process flow, user roles, and benefits for comprehensive IT issue monitoring and resolution.

Reference topics provide additional information for configuring and using Express List.

Express List helps you identify health issues across the datacenter on the Service Operations Workspace. It provides quick information on alerts so you can monitor systems and services,​ resolve alerts, evaluate the alert impact,​ track issues, and report incidents more efficiently.

Enrich automations let you extract values from event payload fields, combine multiple alert fields into a single output field, and map existing alert field values to new values. These actions help standardize alert data for filtering, grouping, and analysis.

Filter the Express List display by text, number, and date attributes using the interactive Express List filter panel. Create a targeted list of alerts to prioritize and focus on.

Add fields to or remove fields from the Express List pane filter using the interactive filter panel. Use filtering to create different views of categorized alerts.

Filters help you create different views of categorized alerts, creating a targeted list of alerts to prioritize and focus on, saving time and minimizing distractions.

Create different views of categorized alerts in Express List by either displaying or filtering out alerts that match a selected alert.

Save your custom view of categorized alerts in Express List to use again, share, or set as your default view. Saving your custom view saves all filters, tags, and conditions.

You can find alerts similar to the alert currently being investigated. Save troubleshooting time by reviewing similar alerts to see how they were resolved.

Track and follow up on work notes while reviewing the service candidate to ensure all actions and updates are captured. This helps maintain clarity and continuity in the review process, reducing the chances of missed details.

Integrate Google Cloud Platform (GCP) with Event Management by adding a standard webhook in the GCP console.

Integrate Grafana with Event Management by adding a standard webhook in the Grafana console.

Integrate Grafana with Event Management with ServiceNow using OAuth authentication.

Integrate Grafana with Event Management by adding Grafana as an authenticated data source.

Grouping automation helps you manage alerts more effectively by collecting similar alerts together. This makes it easier to see patterns, quickly identify issues, and respond efficiently. By organizing alerts in this way, you can reduce alert noise, identify root causes, and assign them to the appropriate teams.

Configure grouping rules to automatically consolidate related alerts into single actionable items for more efficient incident management.

Integrate Honeycomb with Event Management by creating a webhook and configuring it as a trigger in the Honeycomb platform.

Configure ignore rules to automatically suppress alerts that are not actionable or relevant to your operations team.

The Event Management Performance Accelerator plugin helps maintain Event Management performance at a high level. This plugin is optional.

Configure Discovery to lay the groundwork for AIOps success by establishing a key foundation for your team.

Retrieve the most updated apps for the Event Management application (com.glideapp.itom.snac) in the ServiceNow Store. Periodically check the ServiceNow Store for new app versions.

Access Integrations Launchpad to configure and install integrations for Event Management monitoring tools.

Use the domain properties installed with Event Management to provide metadata that identifies the appropriate domain table for event creation.

Integrate Instana with Event Management by adding a standard webhook in the Instana console.