CMDB based alert grouping primary alert

[Verone]

For the OOTB CMDB-based Alert Grouping in Event Management, where can I verify the logic that selects the parent alert? I want to confirm whether the OOTB grouping uses the newest alert as the parent when the group is first created.

[MattSN]

From the docs - https://www.servicenow.com/docs/r/it-operations-management/event-management/alert-group-use-cases.ht...

In Automatic, CMDB, Text-based, and Tag Cluster modes, a virtual alert, representing the oldest and most severe alert in the group, is created as the parent alert.

For a deep dive try reviewing https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0870754

[Preetha K]

1. When a group is first created → first alert becomes parent.

2. Later alerts join as child alerts.

3. If a higher severity alert (e.g., Critical) arrives later → it may be promoted to parent.