Create Ignore automation

Ignore automation streamlines the process of disregarding irrelevant or false-positive alerts from monitoring systems, efficiently managing alert fatigue by filtering out unnecessary notifications. As a result, teams can prioritize and resolve critical issues more effectively.

Avant de commencer

Role required: evt_mgmt_admin, evt_team_operator, or srm_responder

Pourquoi et quand exécuter cette tâche

Ignore automations filter out alerts from source monitoring systems that match specific conditions. Separately, Event Management ignores alerts that have a duplicated message key field or where the severity is Clear.

For users familiar with the classic Event Management experience, ignore automations provide a simpler interface with enhanced team support for the event filter section of event rules.

Remarque :

Ignoring alerts before enriching them improves performance and simplifies the processing flow. The condition filter in ignore automations applies only to the original event, not the enriched one. Enrich automations do not run if Don't run other enrich alert automations is set to false, and another enrich automation with a lower order, the same source, and matching filter conditions already applies. To avoid conflicts, consider the enrich automation order, source, and filter conditions when creating enrichments or event rules.

Procédure

1. Navigate to Workspaces > Service Operations Workspace.
2. From the bottom of the navigation pane, select the AIOps configuration center icon .
   The ITOM AIOps configuration center page appears. The configuration center is a centralized workspace. Use it to configure and manage AIOps features from a single place.
3. On the ITOM AIOps configuration center page, under the Optimize section, select Ignore alerts.
   The Ignore alerts page is displayed.

   Figure 1. Automations page

   

4. Select Create automation.

   

5. In the Automation name field, enter the name of the automation for ignoring alerts.
6. Activate the automation by enabling the Active toggle switch.
7. In the If these conditions are met, don't add an alert in ServiceNow section, set up filter criteria to identify the events you want to capture.
   1. From the Assignment group field menu, select the assignment group to determine which team’s alerts trigger the automation.

      The Assignment group represents a specific team responsible for handling certain alerts. By selecting an assignment group, you ensure that only the alerts assigned to that a particular team trigger the automation. This way, the automation is targeted and only activates for relevant alerts associated with the selected team.

      Remarque :

      • If you’re logged in to the instance with the administrator role (evt_mgmt_admin), all assignment groups are available. Additionally, you can also select All groups to generate alerts for any available group.
      • If you’re an operator, only the group you’re a part of is available.
      • Only members of the selected group or administrators can update or delete the automation.
   2. From the Source field menu, select the monitoring tool from where the alert is generated.
   3. Set up the conditions by selecting the field, operator, and field value. Then, add more conditions using OR or AND operators.

      To add another set of conditions, select + New condition set. If you don’t see an additional info field, you can manually it in the drop-down list.

8. To verify that you’re ignoring the correct events or to see examples of fields that can be used to set the conditions, select Load past events.
   You can preview the details of some past events.
9. In the Automation details section, provide an order and automation description.

   

   1. In the Order field, enter the automation order.
      Remarque :

      Automations run in order from the lowest to the highest.

      The Automation is managed by field displays the team or assignment group who owns, edits, and can delete this automation. The assignment group is the same as the one defined in the If these conditions are met section.

   2. In the Automation description field, enter a brief description of the automation.
10. Select Save automation.
    A notification appears when the automation is successfully saved. Otherwise, an error message is displayed. The ignore automation that you created appears on the Ignore alerts page where you can view, edit, or delete the existing automation.

Que faire ensuite

You can transform raw events into an understandable format by creating Create Enrich automation.