Script behind event to alert creation

[jagarnathn]

Hi ,

Did anyone know the script which used to create   alerts from events in event management ?

Thanks

stark, Could you assist me on the above question ?

[Tony Branton]

In the Kingston release, you'll find the following script includes you can modify, WITH CAUTION:

EvtMgmtCustom_PostTransformHandler

Advanced script to manipulate the Event object after transform. This script can also be used to abort Event processing, effectively ignoring the event. The script can be used in combination with the EvtMgmtCustom_PostBind_Create and EvtMgmtCustom_PostBind_Update scripts.

Use this script with care! Inefficient code may cause a slowdown in event processing.

To abort event processing the method should return false.

EvtMgmtCustom_PostBind_Create

Advanced script to manipulate the Alert object after the related Configuration Item is identified, and before the Alert is created in the database. This script can also be used to abort Alert creation. The script can be used in combination with the EvtMgmtCustom_PostTransformHandler and EvtMgmtCustom_PostBind_Update scripts.

Use this script with care! Inefficient code may cause a slowdown in event processing.

To abort alert creation the method should return false.

EvtMgmtCustom_PostBind_Update

Advanced script to manipulate the Alert object after the related Configuration Item is identified, and before the Alert is updated in the database. This script can also be used to abort Alert update. The script can be used in combination with the EvtMgmtCustom_PostTransformHandler and EvtMgmtCustom_PostBind_Create scripts. Use this script with care! Inefficient code may cause a slowdown in event processing.

To abort alert update the method should return false.

For releases prior to Kingston, there's only the EventRuleUtil script include however this is only used to process event rules applicable to an event and does not offer the same capabilities as the Kingston script includes above.

[Community Alums]

For earlier releases, besides the EventRuleUtil script, what other function(s) are involved in creating an alert from an event?

We are on Jakarta, and the severity value field in the event is set correctly. But in the alert, the severity is not set correctly. We don't have an event transform rule, so we're trying to understand the default logic flow and where this is going wrong.

[Tony Branton]

Severity is typically set by an Event Field Mapping Rule, not an Event Rule.  If an Event Field Mapping Rule is applied then you should see it mentioned in the Activity stream (or Work Notes in the History section) on the Alert form.

To change the severity mapping you can either:

• Modify an existing Event Field Mapping Rule, or
• Create an Event Field Mapping Rule

If you want to retain but not use an OOTB Event Field Mapping Rule, you can:

• Set the OOTB rule to inactive (untick the Active field)
• Copy the OOTB rule (right-click on form header and select Save as)
• Make changes to the copy of the Rule (change the name too)
• Set the Active field to true (i.e. tick it) and save the rule

This way you end up with a rule that should survive an upgrade of your ServiceNow instance (e.g. to Kingston).

Hope this helps.

[arielgritti]

Hello

If you are in Jakarta maybe this can help you to customize the severity field correctly.

https://docs.servicenow.com/bundle/jakarta-it-operations-management/page/product/event-management/concept/c_EMEventFieldMapping.html

I hope my answer has been useful
Ariel
PS: Please mark my answer correct or helpful if I have helped you. Thanks