Tag cluster alert grouping
Tag cluster alert grouping enables you to easily create groups of alerts. It is a non-code method of alert grouping that correlates alerts without having to use CMDB or model training. This simpler way of grouping similar alerts reduces the overall noise of a large quantity of alerts.
Note: To group alerts using tag-based grouping, create a grouping automation in Service Operations Workspace. For more information, see Create Group automation.
Tag cluster alert grouping is enabled immediately after the activation of the Tag-Based Alert Clustering Engine application, available in the ServiceNow Store. This grouping is applied according to the correlation logic order specified in the Configure alert correlation logic order. Alert grouping tags are attached to definitions on a many-to-many (M2M) basis. Multiple tags can be linked to a single definition, and a tag can be part of multiple definitions. Groups formed from tag cluster alert grouping definitions are classified as the Tag Cluster group type.
Tag cluster alert grouping supports domain separation, allowing different domains to have their own distinct alert grouping configurations and logic.
First, create alert grouping tags to define the criteria for grouping alerts. You can set the tags to require an exact match, an approximate ('fuzzy') match, or a character pattern match.
Preconfigured tags are also available to speed up alert clustering. These tags are mapped from alert fields, alert tags, or alert additional info. If the required data is missing and the tag source is Alert CI or Alert CI key, the tag uses the Configuration Item (CI) value from the Configuration Management Database (CMDB). Preconfigured tags include "out of the box" in their description.
You can attach one or more tags to an alert clustering definition, which specifies the conditions for alert correlation. You can either create your own alert clustering definition or use a predefined one provided by the application. Predefined definitions come with associated tags.
Important: Make sure to activate predefined definitions before use. In new systems, several definitions are active by default. The remaining ones must be activated. For more information, see Activate a predefined alert clustering definition.
After tags are attached to a definition, alerts with matching or similar tag values are grouped together. New alerts join an existing group if their tags match those in the definition.
For tag-cluster grouping, alerts are added to a group based on the timeframe defined in the alert clustering settings. The time between the initial alert (virtual alert) and subsequent alerts is evaluated. If two new alerts are received, and their time difference falls within the defined timeframe, they are added to the group. The initial event's generation time is used to determine the relevance of the timeframe.
Related topics
Create an alert clustering definition
Activate a predefined alert clustering definition
Attach a predefined tag to an alert grouping definition
---
title: Tag cluster alert grouping
description: Tag cluster alert grouping enables you to easily create groups of alerts. It is a non-code method of alert grouping that correlates alerts without having to use CMDB or model training. This simpler way of grouping similar alerts reduces the overall noise of a large quantity of alerts.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/it-operations-management/event-management/alert-clustering-tag-definitions-concept.html
release: brazil
product: Event Management
classification: event-management
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 4
breadcrumb: [Mixed alert grouping, Alert grouping types and creation methods, Alert grouping, Configure, Event Management, ITOM AIOps, IT Operations Management]
---
# Tag cluster alert grouping
Tag cluster alert grouping enables you to easily create groups of alerts. It is a non-code method of alert grouping that correlates alerts without having to use CMDB or model training. This simpler way of grouping similar alerts reduces the overall noise of a large quantity of alerts.
**Note:** To group alerts using tag-based grouping, create a grouping automation in Service Operations Workspace. For more information, see [Create Group automation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/event-management/group-alert-sow-itom.md).
Tag cluster alert grouping is enabled immediately after the activation of the Tag-Based Alert Clustering Engine application, available in the ServiceNow Store. This grouping is applied according to the correlation logic order specified in the [Configure alert correlation logic order](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/event-management/configure-alert-correlation-logic-order.md). Alert grouping tags are attached to definitions on a many-to-many \(M2M\) basis. Multiple tags can be linked to a single definition, and a tag can be part of multiple definitions. Groups formed from tag cluster alert grouping definitions are classified as the Tag Cluster group type.
Tag cluster alert grouping supports domain separation, allowing different domains to have their own distinct alert grouping configurations and logic.
First, create alert grouping tags to define the criteria for grouping alerts. You can set the tags to require an exact match, an approximate \('fuzzy'\) match, or a character pattern match.
Preconfigured tags are also available to speed up alert clustering. These tags are mapped from alert fields, alert tags, or alert additional info. If the required data is missing and the tag source is Alert CI or Alert CI key, the tag uses the Configuration Item \(CI\) value from the Configuration Management Database \(CMDB\). Preconfigured tags include "out of the box" in their description.
You can attach one or more tags to an alert clustering definition, which specifies the conditions for alert correlation. You can either create your own alert clustering definition or use a predefined one provided by the application. Predefined definitions come with associated tags.
**Important:** Make sure to activate predefined definitions before use. In new systems, several definitions are active by default. The remaining ones must be activated. For more information, see [Activate a predefined alert clustering definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/event-management/alert-clustering-predefined-definition.md).
After tags are attached to a definition, alerts with matching or similar tag values are grouped together. New alerts join an existing group if their tags match those in the definition.
For tag-cluster grouping, alerts are added to a group based on the timeframe defined in the alert clustering settings. The time between the initial alert \(virtual alert\) and subsequent alerts is evaluated. If two new alerts are received, and their time difference falls within the defined timeframe, they are added to the group. The initial event's generation time is used to determine the relevance of the timeframe.
**Related topics**
[Create alert clustering tags](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/event-management/alert-clustering-tags.md)
[Create an alert clustering definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/event-management/alert-clustering-definitions.md)
[Activate a predefined alert clustering definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/event-management/alert-clustering-predefined-definition.md)
[Attach a predefined tag to an alert grouping definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/event-management/alert-clustering-predefined-tag.md)
[Configure an event rule to customize alert content](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/event-management/t_EMComposeOuput.md)
[Alert tags](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/event-management/alert-tags.md)
| title | Tag cluster alert grouping |
| description | Tag cluster alert grouping enables you to easily create groups of alerts. It is a non-code method of alert grouping that correlates alerts without having to use CMDB or model training. This simpler way of grouping similar alerts reduces the overall noise of a large quantity of alerts. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/it-operations-management/event-management/alert-clustering-tag-definitions-concept.html |
| release | brazil |
| product | Event Management |
| classification | event-management |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 4 |
| breadcrumb | Mixed alert groupingAlert grouping types and creation methodsAlert groupingConfigureEvent ManagementITOM AIOpsIT Operations Management |