Event Management CI binding issue for mixed host and non-host CI classes in event rules

[surasub]

Hi Team,

I’m facing a CI binding issue in ServiceNow Event Management and would appreciate guidance on the best scalable design.

Scenario

We receive ProdMon database events where the Node field contains the CI identifier value (for example: tstmuse2azsql01).

The same logical CI identifier can exist in:

• Hardware class (cmdb_ci_hardware extended classes)
• Non-host classes (for example cmdb_ci_cloud_database)
• potentially many more non-host CI classes in future

The goal is to ensure the alert CI always binds correctly, even when the event node does not belong to a hardware class.

 

Current configuration

I currently have 2 event rules:

Rule 1 — Hardware binding

• Order: 100
• Binding type: CI Identification
• Class: Hardware
• Criterion: name = Node

This works correctly for hardware CIs.

 

Rule 2 — Fallback for non-host CIs

• Order: 200
• Binding type: CI field matching
• CI Type: Configuration Item / dynamic target class
• Node: ${node}
• Manual attribute: name = ${node}

This rule is intended as fallback for non-host CI classes.

 

Observed behavior

Case 1 — CI exists in both hardware + non-host class

If the CI identifier exists in both classes:

• the hardware rule (100) binds successfully
• alert CI gets populated
• works as expected

Case 2 — CI exists only in non-host class

If the CI exists only in a non-host class:

• alert gets created
• CI remains empty
• fallback rule does not populate CI

Case 3 — Remove Node from fallback rule

If I clear Node in the order 200 rule:

• non-host CI binding starts working
• BUT mixed-class scenario breaks
• hardware + non-host precedence no longer behaves correctly

What I need help with

I’m looking for the recommended scalable OOB design for this use case.

Main challenge:

• I cannot create separate event rules for every possible CI class
• future classes may grow into hundreds/thousands
• need one reusable fallback approach

Questions

1. What is the best OOB way to bind non-host CIs dynamically?
2. How should Node field precedence be handled when hardware and non-host classes share the same identifier?
3. Is Event Field Mapping + dynamic CI Type the correct scalable pattern here?
4. Has anyone implemented a generic fallback event rule for mixed CI classes?

Would really appreciate any community best practices or proven patterns.

Thanks in advance!