Hi @AnilPathi
Yes, the Alert Priority Score plays a crucial role in ServiceNow's Event Management module. This score is fundamental to how ServiceNow prioritizes and processes alerts within your IT operations.
Core Function of Alert Priority Score
The Alert Priority Score serves as the primary mechanism for determining which alerts should be addressed first in your ServiceNow environment. Every open alert receives a calculated priority score that directly influences its resolution priority, regardless of its individual severity level. This means an alert with "Major" severity but a low priority group assignment may not be resolved first if its overall priority score is lower than other alerts.
Automated Calculation Process
ServiceNow automatically calculates and recalculates these scores through two key scheduled jobs:
Event Management - Alert Priority Queue runs every 19 seconds and processes batches of 1000 open alerts, calculating priority scores and assigning alerts to their corresponding priority groups. Event Management - Calculate Alert Priority executes every 30 minutes to establish the threshold limits for priority group categories (Urgent, High, Moderate, Low)
.
Priority Score Components
The priority score calculation considers multiple weighted factors:
-
Business Services: Number of impacted services multiplied by their business criticality (weight: 10,000,000)
-
Severity: Alert severity level (weight: 100,000)
-
CI Type: Configuration item classification (weight: 100)
-
Role: Associated role factor (weight: 10)
-
Secondary Alerts: Whether the alert is secondary (no weight if secondary)
-
State: Current alert state (weight: 0.001 for open alerts)
Priority Group Assignment
Based on the calculated score, alerts are automatically categorized into priority groups. The system uses percentage-based thresholds to distribute alerts across four categories: Urgent, High, Moderate, and Low. These thresholds are dynamically recalculated every 30 minutes based on the current distribution of open alerts.
Impact on Incident Management
The priority group assignment (stored in the sn_priority_group field) directly influences how incidents are created from alerts, affecting their Impact and Urgency values. This creates a seamless flow from alert detection to incident prioritization, ensuring that the most critical issues receive immediate attention.
Customization Capabilities
You can modify the priority calculation by adjusting weights in the em_alert_priority_category_order table and remapping category values in the em_alert_priority_category_mapping table. However, these changes affect the default calculation method and should be implemented carefully as they alter how alerts are prioritized across your entire environment. The Alert Priority Score essentially transforms multiple alert characteristics into a single, actionable metric that drives your incident response workflow, making it an indispensable component of effective IT operations management in ServiceNow.
Please also find an extensive explanation of the topic within the following support article: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0870754
Hope that helps
Maik
