What is the best way to close alert if events are coming with same message key but different Sev.

[Rajat Singahl]

We have a integration where element managers are pushing the events to servicenow with same message key, but different Severities and there is only one Associated CI. In such scenarios how can we handle Alert creation and Alert Closure?

[User342536]

Hi@Rajat Singahl ,

Please define with your customer, the message key with the one of the following strategies:

1- Unique event id

2- Push source, metric_name, type, resource, node fields

3- Define alert severities, based in our severities, and create event field map, if necessary.

Check following docs, for further detail:
https://docs.servicenow.com/bundle/xanadu-it-operations-management/page/product/event-management/con...

Kindest Regards,

Rodrigo Donnangelo