Run a remediation workflow on an alert
- UpdatedJul 31, 2025
- 2 minutes to read
- Zurich
- Event Management
As an Event Management operator, you can also run a workflow on your ServiceNow instance that helps remediate the alert. For example, you might run a workflow that automatically restarts a server on your network, which might resolve an alert about CPU usage.
Before you begin
Note: The Operator Workspace interface is available only to customers who have upgraded from a release prior to the Utah release. New customers as of the Utah release can use the Service Operations Workspace for ITOM, which offers an enhanced UI for managing alerts.
Phase 1 |
|
|
Phase 2 |
|
Triage alerts |
Phase 3 |
|
Note: You can run a remediation workflow if your administrator already set up
workflows for you to choose from. You should be familiar with your
organization’s policies regarding triaging of alerts.
Role required: evt_mgmt_operator
Procedure
-
On the Alert form, click Quick Response.
-
In the Quick Response window, click the name of the remediation under
Run Remediation.
What to do next
There are also other tasks you can take as part of the triage stage:
- Launch a web application from an alert to open a website or an event monitoring tool that provides more information about the alert.
- Put an alert into maintenance to temporarily hide it from the Service Operations Workspace dashboard if the alert does not require action at this time.
- Associate a knowledge base article with an alert if there is existing information about the alert that might help resolve the underlying issue.
If you do not need to perform any other triage actions, proceed to Phase 3: Close an alert.