Set Incident Priority from Alert/Event description

Khanna Ji · ‎06-25-2019

I am receiving alert/event priority/severity from alerting tool under description and name. What is the best way to set the incident priority based on that?

Do you suggest to create a custom BR for setting the priority of the incident or is there any setting which can be utilized?

vNick · ‎06-25-2019

If you're event source isn't mapping to the "severity" field of the event or alert, then your event rule (might need to add one) needs to take the value from the additional info field and map it to severity (might have to create an event field mapping entry if the source doesn't use the same severity codes as ServiceNow, 0, 1, 2, 3, 4, 5).

In London, when we introduced alert management rules, there also became a set of Flow Designer actions and flows for creating an incident. The action "Calculate Values (Based on the Alert)" has logic for setting incident fields... a snippet is below that sets the Urgency of the incident

var getIncidentUrgency = function(){
var incidentSeverity;
if(inputs.severity == 1 || inputs.severity == 2)
incidentSeverity = 1;
else if (inputs.severity == 3 || inputs.severity == 4)
incidentSeverity = 2;
else if (inputs.severity == 5)
incidentSeverity = 3;

return incidentSeverity;
}

View solution in original post

Mike Allen · ‎06-25-2019

First, set impact and urgency, not priority. I'd just have a before insert BR that sets the values based on the condition. You don't even need scripting.

Khanna Ji · ‎06-25-2019

I need to write a script in the BR to fetch the string from short description like Critical or High and then set the Impact and Urgency.

Is this an idea way to do or anything else needs to be setup in the event rules or alert rules?

Mike Allen · ‎06-25-2019

Not even a script. Set the condition to be Short description CONTAINS Critical and on the second tab, set field values like Urgency is 1 and Impact is 1 and that will set the Priority.

Khanna Ji · ‎06-25-2019

Got that but alerting tool is sending the data in additional information field of an event and that details are not getting carry forwarded on to the incident. Any idea how can I get those details into Incident from an event?