--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Tag cluster alert grouping # Tag cluster alert grouping {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Tag cluster alert grouping Tag cluster alert grouping in ServiceNow Australia release provides a non-code method to group similar alerts efficiently, reducing alert noise without relying on CMDB or model training. It operates through the Tag-Based Alert Clustering Engine application, which you activate from the ServiceNow Store and configure via Service Operations Workspace. This method applies grouping based on tag correlations defined in alert grouping definitions and respects domain separation, allowing customized configurations per domain. Show full answer Show less ## Key Features * **Tag-based grouping:** Create alert grouping tags that specify criteria using exact, fuzzy, or pattern matching to correlate alerts. * **Predefined tags and definitions:** Use out-of-the-box tags and alert clustering definitions mapped from alert fields or CMDB data, accelerating setup. Predefined definitions require activation before use. * **Many-to-many tag relationships:** Multiple tags can be linked to multiple alert clustering definitions, enabling flexible and complex grouping scenarios. * **Timeframe-based grouping:** Alerts are grouped within a defined timeframe using the initial alert's generation time to evaluate relevance for grouping subsequent alerts. * **Domain separation support:** Enables different domains to maintain independent alert grouping rules and logic. ## Practical Application To implement tag cluster alert grouping, create or activate alert clustering definitions and attach appropriate tags that define grouping logic. Incoming alerts with tags matching these definitions within the configured timeframe will be automatically grouped, consolidating alert noise and improving operational visibility. This helps ServiceNow customers streamline alert management and accelerate incident response by focusing on correlated alert clusters rather than individual alerts. ## Next Steps * Create alert clustering tags tailored to your alert data characteristics. * Create or activate alert clustering definitions and attach tags to define grouping criteria. * Configure alert correlation logic order and alert clustering timeframes according to your operational needs. * Set up grouping automation in Service Operations Workspace to enable tag-based alert grouping. Tag cluster alert grouping enables you to easily create groups of alerts. It is a non-code method of alert grouping that correlates alerts without having to use CMDB or model training. This simpler way of grouping similar alerts reduces the overall noise of a large quantity of alerts. Note: To group alerts using tag-based grouping, create a grouping automation in Service Operations Workspace. For more information, see [Create Group automation](https://www.servicenow.com/docs/dzmFiicpe800NSz3XP_fGw "Grouping automation helps you manage alerts more effectively by collecting similar alerts together. This makes it easier to see patterns, quickly identify issues, and respond efficiently. By organizing alerts in this way, you can reduce alert noise, identify root causes, and assign them to the appropriate teams."). Tag cluster alert grouping is enabled immediately after the activation of the Tag-Based Alert Clustering Engine application, available in the ServiceNow Store. This grouping is applied according to the correlation logic order specified in the [Configure alert correlation logic order](https://www.servicenow.com/docs/PkxlUiPg9RQ1N~ga~acDLA "Improve alert management by enabling users to customize correlation logic order. This feature empowers you to fine-tune correlation methods to their specific needs, enhancing alert prioritization and response efficiency."). Alert grouping tags are attached to definitions on a many-to-many (M2M) basis. Multiple tags can be linked to a single definition, and a tag can be part of multiple definitions. Groups formed from tag cluster alert grouping definitions are classified as the Tag Cluster group type. Tag cluster alert grouping supports domain separation, allowing different domains to have their own distinct alert grouping configurations and logic. First, create alert grouping tags to define the criteria for grouping alerts. You can set the tags to require an exact match, an approximate ('fuzzy') match, or a character pattern match. You can also use preconfigured tags to speed up alert clustering. These predefined tags are mapped from alerts and are based on information from sources such as the Alert field, Alert tags, or Alert additional info. If the required data is missing and the selected tag source is Alert CI or Alert CI key, the tag is populated using the Configuration Item (CI) value. This value comes from Configuration Management Database (CMDB). Predefined tags are easily identified by their description, which includes out of the box. You can attach one or more tags to an alert clustering definition, which specifies the conditions for alert correlation. You can either create your own alert clustering definition or use a predefined one provided by the application. Predefined definitions come with associated tags. Important: Make sure to activate predefined definitions before use. In new systems, several definitions are active by default. The remaining ones must be activated. For more information, see [Activate a predefined alert clustering definition](https://www.servicenow.com/docs/f3X0t2BVNBxQCiLuaH6VWw "Activate the predefined alert clustering definitions provided with the Tag-Based Alert Clustering Engine application before use. Utilizing these preconfigured definitions minimizes setup time and ensures a more efficient configuration process, allowing for quicker implementation and streamlined alert management."). Once one or more alert clustering tags are attached to a definition, the system collects alerts. It then checks if their tags match all the tag values specified in the definition. Alerts with matching or similar tag values are grouped together. New incoming alerts join an existing group if their tags match the tags in the definition used to create the group. For tag-cluster grouping, alerts are added to a group based on the timeframe defined in the alert clustering settings. The time between the initial alert (virtual alert) and subsequent alerts is evaluated. If two new alerts are received, and their time difference falls within the defined timeframe, they are added to the group. The initial event's generation time is used to determine the relevance of the timeframe. **Related concepts** * [Alert tags](https://www.servicenow.com/docs/Q7Zs5Xo5Mq1OZ9Pj1OJxTw "Alert tags consolidate normalized alert fields (key/value) across sources, improving alert quality for correlation and expanding out-of-the-box TBAC (Tag Based Automatic Correlation) definitions.") **Related tasks** * [Create alert clustering tags](https://www.servicenow.com/docs/fOTLSpzw5nJ01Dc31dARTQ "Create streamlined alert correlations with alert clustering tags by grouping alerts that share identical or similar tags based on your configured match method. This reduces noise, enhances incident prioritization, and improves operational efficiency, enabling faster issue resolution and response times.") * [Create an alert clustering definition](https://www.servicenow.com/docs/_3di~uHqq03kxfBJEwB9pw "Define alert clustering conditions to trigger one or more alert clustering tags, which help create alert groups from fewer alerts. Creating alert groups from fewer alerts reduces noise, making it easier to identify critical incidents, prioritize responses, and manage issues effectively.") * [Activate a predefined alert clustering definition](https://www.servicenow.com/docs/f3X0t2BVNBxQCiLuaH6VWw "Activate the predefined alert clustering definitions provided with the Tag-Based Alert Clustering Engine application before use. Utilizing these preconfigured definitions minimizes setup time and ensures a more efficient configuration process, allowing for quicker implementation and streamlined alert management.") * [Attach a predefined tag to an alert grouping definition](https://www.servicenow.com/docs/b7K8IT40kT7N4P4kQYQD1Q "Get started faster with alert clustering by attaching a predefined alert clustering tag to a tag-based alert clustering definition in Event Management. By associating a predefined tag, you ensure that alerts meeting the specified criteria are grouped effectively, facilitating quicker identification and response to related incidents.") * [Configure an event rule to customize alert content](https://www.servicenow.com/docs/Y3NW_Zf4XmGTuFUaeebPHg "You can configure an event rule to customize alert content. You can customize the order of the fields and select which fields display. The fields in the left-hand work area of the Transform and Compose Alert Output section of an event rule are the fields that appear in the generated alert.")