---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Create an incident or security incident from an alert

# Create an incident or security incident from an alert {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

When an alert must be escalated and assigned to someone who can resolve the underlying
issue, you can open an incident.

## Before you begin

Role required: evt_mgmt_admin, evt_mgmt_operator, or evt_mgmt_user

## About this task

If Security Incident Response is
activated, a security incident can be created.

You can manually create incidents and security incidents from the Alert form. To prevent
duplicate tasks, the system checks the conditions of all task templates before creating an
incident.

You can customize the created incident using the
EvtMgmtCustomIncidentPopulator.populateFieldsFromAlert script
include. The customization includes mapping fields from the alert to the incident or
aborting the incident creation according to customized conditions. For more information, see
[Custom alert fields](https://www.servicenow.com/docs/~oP9VoUE5ARoKfWi30ZXGA "You can populate custom alert fields with data contained in Additional information field of the event.").

You can populate incident fields using custom alert fields values that where populated from
additional information fields. Use the EvtMgmtCustomIncidentPopulator
script include to copy the values to the incident after copying the data to the alert. For
more information, see [Custom alert fields](https://www.servicenow.com/docs/~oP9VoUE5ARoKfWi30ZXGA "You can populate custom alert fields with data contained in Additional information field of the event.").  
Note:  
If Security Incident Response is activated, the base system includes an alert action rule called Create security incidents for critical alerts. This alert action rule creates security incidents when critical security events are reported.

## Procedure

1. Navigate to AllEvent ManagementAll Alerts.
2. Click the alert Number.
3. To create an incident:
   * To create an incident, click Quick Incident.
   * To create a security incident, click Create Security Incident. You must install the Security (secops) plugin to enable this option.
4. Click Update.

## Result

The created incident appears in the Task field of the Alert form.
**Related topics**   

* [Security incidents created from events and alerts](https://www.servicenow.com/docs/access?context=c_ScIncdUseAlrts&version=yokohama&pubname=yokohama-security-management&ft:locale=en-US)

*[\>]: and then