What’s New in Alert Automation: Everything We Shipped in 2026

YuvalMamka · an hour ago

2026 in review

Event Management · Alert Automation

What’s New in Alert Automation:
Everything We Shipped in 2026

New grouping criteria, Advanced Options that make groups more meaningful, AI-driven grouping recommendations, and a simpler way to create incidents. Here’s the full rundown for Event Management admins.

Quick refresher

Four steps from event to action

Alert Automation, in Service Operations Workspace, is where you configure how alerts are processed—no code required. Every automation falls into one of four stages, and this year brought improvements to almost all of them.

≡

Ignore

Drop false positives before they become alerts.

✦

Enrich

Add context and bind alerts to the right CI.

⇄

Group

Collapse related alerts into one actionable group.

!

Respond

Create incidents, notify, and remediate.

Group automation

Smarter grouping, less noise

Grouping got the biggest update this year. Mixed Group automations gained two new grouping criteria, and a new Advanced Options section lets you decide exactly when a group is worth creating.

New grouping criteria · March 2026

Related log properties

Group Health Log Analytics alerts and Event Management alerts together in a single group. When a log anomaly and a monitoring alert describe the same problem, your operators now see them side by side instead of in two separate places.

Impacted service instance

Group alerts by the service instance they affect, so your groups line up with how your organization owns and supports its services.

Advanced Options · March 2026

Not every match deserves a group. Advanced Options lets you set prerequisites that must be met before a group is formed:

Minimum threshold

Set how many alerts (two or more) must match the rule before the group forms. You get fewer, more concise groups instead of lots of small ones.

Seed alert

Define a filter that at least one alert in the group must meet before the group forms. The result is groupings that are anchored on the alerts that matter most.

Try this

Combine both options on a noisy rule. For example, require at least three matching alerts and a seed alert with critical severity. Then use simulation to compare the groups the rule creates before and after, and activate it once you’re happy with the result.

AI

Proactive Grouping RecommendationsJune 2026

Instead of writing grouping rules from a blank page, review AI-generated suggestions on the Alert Automation Group page. A data science model analyzes your alerts on a recurring schedule and proposes grouping automations you can review, simulate, and activate in one click. Powered by ServiceNow Otto. For a deep dive, read Stop Fighting Alert Noise. Let ServiceNow Recommend the Groups for You.

AI

Configure with AI for grouping2026

Select Configure with AI and describe the grouping rule you want in plain language—no form-filling required. The AI agent works out your intent and asks clarifying questions for any missing details. It then shows you a full preview of the proposed rule and creates it as an inactive grouping automation, ready for you to simulate, save, or activate. It’s available out of the box with ServiceNow Otto for ITOM.

Grouping quality fixes

Alerts you manually remove from a group are no longer automatically re-added.
The simulation view now shows “This automation” or the saved automation name, instead of generic Mixed or CMDB labels.
Inactive grouping automations can now be saved and updated.

Respond automation

Creating incidents from alerts, unified

!

Unified incident creationMarch–May 2026

Create Incident now uses one unified flow, whether you create the incident manually from Express List or automatically from a response automation. The flow includes customizable field mapping, and the Alert Automation UI was updated in May to match the new flow built around Create Incident Advanced.

✓

Static values for incident fieldsAugust 2026

In the Create Incident Advanced action, you can now enter static text values for fields such as urgency and priority, in addition to mapping values from alert fields. That gives you back the flexibility to set fixed values where your process needs them.

Enrich automation

Better context, better CI binding

⇄

CI binding enhancementsMarch 2026

An improved CI binding workflow with fallback support, binding simulation, and a refreshed UI for selecting and mapping alert fields to CI attributes. Test how alerts bind to CIs before the change affects production alerts.

≡

Multiline text in compose actionsAugust 2026

The compose action text field on the Enrich page now supports multiple lines. The box resizes and keeps line breaks and spacing, so formatted alert descriptions render correctly downstream.

✦

Clearer regex error messagesMay 2026

When a regular expression in an automation is invalid, the error message now does a better job of telling you what to fix.

How to get these updates

Alert Automation features are delivered through ServiceNow Store apps, so you don’t need to wait for a family upgrade. Update the AIOps Experience, Event Management Core, and Tag Based Alert Clustering Engine apps to the latest versions. Check each app’s Store listing for family compatibility before you upgrade.

Update your apps,
then tell us what you think.

Which of these will you try first? Share your feedback and questions in the comments—we read every one.

Read the release notes Event Management docs

Related documentation