Change automatic work notes from alerts in incidents

[erlfos]

Hi

When an alert is closed or reopened we will get a work note in the associated incident, like this:
"The related alert Alert4069506 state is now Reopen"

"The related alert Alert4069506 state is now Closed"

This can cause a huge number of work notes if an alert is changing state often, and it may drown out other useful work notes in the incident. How can we change this behavior? We would like to move these notes to a custom journal field if possible.

EDIT:
I think I have found the place where the magic happens. It is most likely this line in the "Script include" "EvtMgmtAlertMgmtAlertReopenHandler":

// Incident is still open, just add a comment to it
this.updateWorkNoteField(task, gs.getMessage("The related alert {0} state is now {1}", [alertNumber, current.state]));
task.update();

The question is then, if I edit this script  will it break when we upgrade the system?

[Harneet Sital]

Hi Elfos, 

Ideally not too much, you can still amend the script include with a caveat that with upgrades if this is skipped then properly analyze the new code and merge with these changes. This completely depends on the level of governance done with your customer. 

Another messy way of doing this will be to just ignore the work note if such an update is coming via a custom BR (won't recommend this).

If it does not happen too very often, it's still okay to keep the work notes and see how many times users were affected by this. 

-Harneet Sital
Request you to please mark my answer as helpful or correct based on the impact
Find all my ServiceNow articles here