Incident Correlation(Event Manegement)

[csatish]

Can anyone please guide me on my requirement,  I am working on incident noise reduction.
When a primary alert creates an incident, I want all correlated/secondary alerts to map to the same incident automatically.
What rules/configuration are required to achieve this? Ant step-by-step guidance would be helpful.

Thanks

[Tanushree Maiti]

Hi @csatish 

Check this link /KB , if it helps.

https://www.servicenow.com/community/itom-forum/avoid-creation-of-incidents-for-secondary-alerts-whe...

https://hiscope1.service-now.com/kb?id=kb_article_view&sysparm_article=KB0852856

Also check :https://www.servicenow.com/community/itom-forum/alert-configuration/m-p/3479299

[SohamTipnis]

Hi @csatish,

Maybe this documentation will help:

https://www.servicenow.com/docs/r/zurich/it-operations-management/event-management/c_EM.html

https://www.servicenow.com/docs/r/zurich/build-workflows/system-events/events.html

https://www.servicenow.com/docs/r/zurich/security-management/security-incident-response/arcsight-esm...

https://www.servicenow.com/docs/r/zurich/security-management/security-incident-response/arcsight-esm...

Let me know if this helps!!!!😉

If you find my answer useful, please mark it as Helpful and Correct. ‌‌😊

Regards,
Soham Tipnis
ServiceNow Developer || Technical Consultant
LinkedIn: www.linkedin.com/in/sohamtipnis10

[AndersBGS]

Hi @csatish 

You are talking about alert correlation and correlation rules in ITOM event management - not incident correlation. Have you looked into the product documentation according to this? Where do you experience issues?