Hello,
I have seen like incident created from Contact type Event and originating from cloud watch that have configuration item was get removed by mid server.
These alerts are part of EKS infrastructure, alarms are created as part of standard monitoring procedure. They are originating from Cloud Watch.
The CI is parsed from the alarm name. When I look at the INC's shared, the alarm name looks correct.
"Alarm Name" : "Moderate - cert-manager - PodNumberContainerRestarts-us-east-1-cert-manager>0-5minutes",
ServiceNow should have looked for " – " on both sides of cert-manager and parsed that string as the CI.
Thank You
