Create a security incident from an Event Management alert

---
title: Create a security incident from an Event Management alert
description: When Event Management is activated, you can manually create security incidents from the Alert form.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/manually-create-si-from-em-alert.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Security incident manual creation, Security incident creation, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Create a security incident from an Event Management alert

When Event Management is activated, you can manually create security incidents from the Alert form.

## Before you begin

The Event Management plugin requires a separate subscription and must be activated by ServiceNow personnel. This plugin includes demo data and activates related plugins if they are not already active. The Service Analytics is activated automatically when Event Management is activated.

Role required: evt\_mgmt\_admin, evt\_mgmt\_operator, or evt\_mgmt\_user

## Procedure

1.  Navigate to **All** > **Event Management** > **All Alerts**.

2.  Click the alert **Number**.

3.  Click **Create Security incident**.

4.  Click **Update**.