This is a known behavior with the Express List faceted filters in Service Operations Workspace. When you select multiple values from the "Impacted services" checkbox filter, it treats them as AND (the alert must contain all selected services). There's no toggle within that faceted filter UI to switch it to OR.
The fix: Use the "Use advanced filters" toggle.
You can see it right there in your screenshot — the toggle that says "Use advanced filters" is currently off. Turn it on, and you'll get the full condition builder instead of the checkbox-style facets. From there you can build your filter like:
Impacted services CONTAINS Core network gear- OR
Impacted services CONTAINS firewall
- OR
Impacted services CONTAINS iconic
The condition builder gives you explicit control over AND/OR between each condition row, so you can set it to OR for each additional impacted service value.
Once you've built the filter the way you want, you can save it as a new named filter using "Save as new" so you don't have to rebuild it each time.
Why the faceted filter defaults to AND: For list-type fields (like cmdb_ci_list fields), the faceted filter interprets multiple selections as "must contain all of these," which is the CONTAINS with AND logic you're seeing in that tooltip. This is by-design behavior in the Express List component — the faceted checkbox UI simply doesn't expose an AND/OR toggle. The advanced filter is the intended path for OR logic.
