---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Alert tags

# Alert tags {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Alert tags consolidate normalized alert fields (key/value) across sources, improving alert quality for correlation and expanding out-of-the-box TBAC (Tag Based Automatic Correlation) definitions.

## Example: Field normalization in alert management {#alert-tags__section_qym_qbg_5fc}

In some cases, the same information may exist under different field names across data sources. For instance, an incoming event from one source has the location stored under the field region, but in other
source, the same information is captured under impacted_region. To avoid confusion and enable consistent grouping, filtering, or automation, we normalize these fields by creating a unified field --- for
example,t_region. This field pulls the value from region or from impacted_region depending what field is present in the event. This way, the normalized
field t_region always holds the location value in a consistent manner, regardless of the original source field.

Alert tags field appears in the Alerts form. These tags are created by Event Rules and in Event mapping and are saved in the alert tags' table
\[em_alert_tags\]. The naming convention for key/value pairs is t_\<tag name\>. Tags can be reused in event rules by selecting previously
defined tags. When new alert tags are defined, TBAC (Tag Based Alert Clustering) tags are automatically created, enabling new TBAC alert clustering definitions from the new tag source.