What are Correlation Rules in Event Management
Correlation rules in ServiceNow Event Management are used to group multiple related events into a single alert.
This helps reduce noise and avoids creating multiple incidents for the same underlying issue.
Correlation Rule Script
(function correlate(current, previous) {
if (current.node == previous.node &&
current.source == previous.source) {
return true;
}
return false;
})(current, previous);Example:
If a server goes down, monitoring tools may send multiple events like CPU, memory, disk, and ping failures.
Correlation rules identify that these events belong to the same CI and group them into one alert.
Correlation is applied after events are created in the em_event table and before or during alert creation in em_alert.
How events come into the em_event table
Events can enter ServiceNow in two common ways.
1. MID Server based integration
Monitoring tools like SCOM, SolarWinds, Nagios, etc., send events to a MID Server.
The MID Server forwards the data to ServiceNow through the ECC Queue.
ServiceNow processes the payload and inserts records into the em_event table.
Flow:
Monitoring Tool → MID Server → ECC Queue → em_event
2. REST API based integration
External monitoring tools can directly send events using the Event Management REST API.
API endpoint:
POST /api/global/em/jsonv2
Sample payload:
{
"source": "Nagios",
"node": "linux-server-01",
"type": "CPU",
"severity": "2",
"description": "CPU usage crossed threshold"
}
Each record in the payload creates one entry in the em_event table.
Configuration on Monitoring Tool side
On the monitoring tool side, you usually configure:
Event forwarding or webhook setup
ServiceNow endpoint or MID Server details
Authentication credentials
Event payload fields such as source, node, severity, metric, description
The goal is to send clean and meaningful events.
Configuration on ServiceNow side
On the ServiceNow side, you need:
Event Management plugin enabled
MID Server configured (if using agent based integration)
Event Rules to map incoming events to alerts
Correlation Rules to group related events
CI mapping to link events to CMDB
Alert Management Rules to create incidents or notifications
Simple Correlation Rule example
Correlation based on same source and node within a time window.
Logic:
If multiple events come from the same source and node within 5 minutes, correlate them into one alert.
What happens after event ingestion
Event inserted into em_event
Event Rules evaluated
Correlation Rules applied
Alert created or updated in em_alert
Incident created if configured
*************************************************************************************************************
If this response helps, please mark it as Accept as Solution and Helpful.
Doing so helps others in the community and encourages me to keep contributing.
Regards
Vaishali Singh
