Tag cluster alert grouping
Summarize
Summary of Tag cluster alert grouping
Tag cluster alert grouping is a no-code alert correlation method that helps ServiceNow customers efficiently group similar alerts without relying on CMDB data or machine learning model training. This feature reduces alert noise by clustering related alerts based on tags, making alert management simpler and more effective.
Show less
This capability is enabled immediately after activating the Tag-Based Alert Clustering Engine application, available from the ServiceNow Store. Alert grouping is applied according to a configurable correlation logic order, and supports multiple tags linked to grouping definitions on a many-to-many basis. Groups formed through this method are identified as the Tag Cluster group type.
Tag cluster alert grouping supports domain separation, enabling different domains within your organization to maintain independent alert grouping configurations and correlation logic.
Key Features
- Tag creation and matching: Define alert grouping criteria by creating tags that require exact matches, approximate (fuzzy) matches, or pattern matches.
- Predefined tags and definitions: Use out-of-the-box tags and alert clustering definitions to accelerate setup. Predefined tags map from alert fields, tags, or additional info, and may populate missing Configuration Item data from the CMDB.
- Alert clustering definitions: Attach one or more tags to a definition that specifies alert correlation conditions. Both custom and predefined definitions are supported; predefined ones must be activated before use.
- Timeframe-based grouping: Alerts are grouped if their tag values match and their occurrence times fall within a configured timeframe relative to the initial alert.
Practical Application
After setting up tags and attaching them to clustering definitions, the system automatically collects alerts and groups those with matching tags according to the defined timeframe. This dynamic grouping helps teams focus on consolidated alert groups rather than individual alerts, improving operational efficiency.
Next Steps
- Create and configure alert clustering tags based on your alert data and grouping needs.
- Create or activate alert clustering definitions, including predefined definitions for faster deployment.
- Attach tags to alert clustering definitions to specify correlation criteria.
- Configure event rules as needed to customize alert content for better tagging and grouping.
Tag cluster alert grouping enables you to easily create groups of alerts. It is a non-code method of alert grouping that correlates alerts without having to use CMDB or model training. This simpler way of grouping similar alerts reduces the overall noise of a large quantity of alerts.
Tag cluster alert grouping is enabled immediately after the activation of the Tag-Based Alert Clustering Engine application, available in the ServiceNow Store. This grouping is applied according to the correlation logic order specified in the Configure alert correlation logic order. Alert grouping tags are attached to definitions on a many-to-many (M2M) basis. Multiple tags can be linked to a single definition, and a tag can be part of multiple definitions. Groups formed from tag cluster alert grouping definitions are classified as the Tag Cluster group type.
Tag cluster alert grouping supports domain separation, allowing different domains to have their own distinct alert grouping configurations and logic.
First, create alert grouping tags to define the criteria for grouping alerts. You can set the tags to require an exact match, an approximate ('fuzzy') match, or a character pattern match.
You can also use preconfigured tags to speed up alert clustering. These predefined tags are mapped from alerts and are based on information from sources such as the Alert field, Alert tags, or Alert additional info. If the required data is missing and the selected tag source is Alert CI or Alert CI key, the tag is populated using the Configuration Item (CI) value from the Configuration Management Database (CMDB). Predefined tags are easily identified by their description, which includes out of the box.
You can attach one or more tags to an alert clustering definition, which specifies the conditions for alert correlation. You can either create your own alert clustering definition or use a predefined one provided by the application. Predefined definitions come with associated tags.
Once one or more alert clustering tags are attached to a definition, the system collects alerts and checks if their tags match all the tag values specified in the definition. Alerts with matching or similar tag values are grouped together. New incoming alerts join an existing group if their tags match the tags in the definition used to create the group.
For tag-cluster grouping, alerts are added to a group based on the timeframe defined in the alert clustering settings. The time between the initial alert (virtual alert) and subsequent alerts is evaluated. If two new alerts are received, and their time difference falls within the defined timeframe, they are added to the group. The initial event's generation time is used to determine the relevance of the timeframe.