Alert tags · SN Doc Reader

Alert tags

concept australia Updated Sep 10, 2026 1 min read alert-tags.md

Alert tags consolidate normalized alert fields (key/value) across sources, improving alert quality for correlation and expanding out-of-the-box TBAC (Tag Based Automatic Correlation) definitions.

Example: Field normalization in alert management

In some cases, the same information may exist under different field names across data sources. For instance, an incoming event from one source has the location stored under the field region, but in other source, the same information is captured under impacted_region. To avoid confusion and enable consistent grouping, filtering, or automation, we normalize these fields by creating a unified field — for example,t_region. This field pulls the value from region or from impacted_region depending what field is present in the event. This way, the normalized field t_region always holds the location value in a consistent manner, regardless of the original source field.

Alert tags field appears in the Alerts form. These tags are created by Event Rules and in Event mapping and are saved in the alert tags' table [em_alert_tags]. The naming convention for key/value pairs is t_<tag name>. Tags can be reused in event rules by selecting previously defined tags. When new alert tags are defined, TBAC (Tag Based Alert Clustering) tags are automatically created, enabling new TBAC alert clustering definitions from the new tag source.

25 lines · 2.0 KB Wrap lines

---
title: Alert tags
description: Alert tags consolidate normalized alert fields \(key/value\) across sources, improving alert quality for correlation and expanding out-of-the-box TBAC \(Tag Based Automatic Correlation\) definitions.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/event-management/alert-tags.html
release: australia
product: Event Management
classification: event-management
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Processing Events, Configure, Event Management, ITOM AIOps, IT Operations Management]
---

# Alert tags

Alert tags consolidate normalized alert fields \(key/value\) across sources, improving alert quality for correlation and expanding out-of-the-box TBAC \(Tag Based Automatic Correlation\) definitions.

## Example: Field normalization in alert management

In some cases, the same information may exist under different field names across data sources. For instance, an incoming event from one source has the location stored under the field **region**, but in other source, the same information is captured under **impacted\_region**. To avoid confusion and enable consistent grouping, filtering, or automation, we normalize these fields by creating a unified field — for example,**t\_region**. This field pulls the value from **region** or from **impacted\_region** depending what field is present in the event. This way, the normalized field **t\_region** always holds the location value in a consistent manner, regardless of the original source field.

Alert tags field appears in the Alerts form. These tags are created by Event Rules and in Event mapping and are saved in the alert tags' table \[em\_alert\_tags\]. The naming convention for key/value pairs is t\_&lt;tag name&gt;. Tags can be reused in event rules by selecting previously defined tags. When new alert tags are defined, TBAC \(Tag Based Alert Clustering\) tags are automatically created, enabling new TBAC alert clustering definitions from the new tag source.