--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Viewing links between alerts in alert groups # Viewing links between alerts in alert groups in Express List {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Viewing links between alerts in alert groups in Express List Link View in Express List provides a visual representation of the relationships between alerts within alert groups generated by Event Management. It helps ServiceNow customers understand how alerts are connected through their attributes, including configuration items (CIs) and other environment elements. This visualization aids in rapid triage and impact analysis without requiring a fully populated Configuration Management Database (CMDB), though having a populated CMDB enhances the insights by showing probable causes and impacted services. Show full answer Show less ## Key Features * **Visual Representation:** Colored tags represent CIs and environment items linked to alerts, with nodes that can be dragged for focused analysis. * **Manual Refresh:** Link View does not auto-refresh; users must manually refresh to update the layout. * **Impact Identification:** If an alert on a CI affects a service in the CMDB, the impacted service is displayed for quick triage. * **Stacked Nodes and Badges:** Nodes show badges indicating the number of alerts sharing the same key-value pair; a "Change" badge marks active change requests as probable causes. * **Legend and Filtering:** The legend explains symbols, colors, and link types (solid lines indicate shared alerts; dotted lines indicate correlation by grouping criteria), and allows toggling tag visibility to reduce noise. * **Tooltips:** Hovering over nodes reveals details such as tag name, class, severity, alert count, and roles (primary, secondary, probable cause). * **Supported Alert Group Types:** Link View supports tag-based, rules-based, CMDB-based, network traffic-based, log analytics-based, and mixed alert groups. ## Practical Benefits ServiceNow customers can quickly identify relationships between alerts, understand the probable causes, and see service impacts, facilitating efficient incident response and root cause analysis. The ability to filter and manually arrange nodes enables focused investigation tailored to customer needs. Gain a better understanding of the relationships between alerts in alert groups in the Express List by using Link View. Link View offers a visual representation of the relationships between the alerts in a group. When Event Management generates an alert group, Link View shows how the attributes of the alerts in the group are linked. The colored tags represent configuration items (CIs) and other environment items in relation to the alerts. The information shown in Link View is available without the need for a populated Configuration Management Database (CMDB). However, when the CMDB is populated, Link View offers additional value by providing the probable cause of the alerts and the service that the alert group impacts. Figure 1. Sample alert group in Link View You can focus on your areas of interest by dragging the nodes in Link View to different positions. When you refresh an alert group, rearranged nodes appear in their original position again. Therefore, Link View is not refreshed automatically, but waits for you to do so manually. If an alert on a CI impacts a service in the Configuration Management Database (CMDB), Link View shows the impacted service for quick triage. A stacked node indicates that multiple nodes were mapped for the same tag. When the same key-value pair appears in more than one alert, the corresponding node is shown with a badge. For example, when the same key-value pair appears in two alerts, the badge on the node shows the number 2. See the Payment tracker node in the sample alert group figure. When a node has no badge, the key-value pair appears in only one alert. An active change request, a probable cause of the alert, is marked by a Change badge. Figure 2. Node with a change badge The Link View legend lists the meaning of the symbols and colors used and enables you to toggle between hiding and showing types of tags to reduce noise. In addition, the legend describes the meaning of the various lines linking the alert attributes. Attributes linked by a solid line share one or more alerts, whereas attributes linked by a dotted line are correlated by grouping criteria. For a description of each tag, see [Attributes in Express List Link View](https://www.servicenow.com/docs/wV35aBvggVR8mcRaT4IOgg "The table lists the node attributes available in Link View with their icon and description."). Hovering over a node displays a tooltip that includes the name of the tag, its class, its severity, and the number of alerts in which it appeared. The tooltip also indicates whether the alert is primary or secondary or the probable cause of the alert, if applicable. Figure 3. Node tooltip Currently, Link View is supported for several alert groups. For more information, see the following topics: * [Viewing links between alerts in tag-based alert groups](https://www.servicenow.com/docs/wi4tsvvCmpBcNaZfwCaqZg "View the connections between alerts in a tag-based alert group in Express List by using Link View. Link View shows how the attributes of the alerts in the group are linked with each other.") * [Viewing links between alerts in rules-based alert groups](https://www.servicenow.com/docs/cOcYnw_vPi3uilCLHYQxEQ "View the connections between alerts in a rules-based alert group in Express List by using Link View. Link View shows how the attributes of the alerts in the group are linked with each other.") * [Viewing links between alerts in CMDB-based alert groups](https://www.servicenow.com/docs/~rsbB0hEBSZgJrVAfIc0Fw "View the connections between alerts in alert groups in Express List that were created based on the proximity of Configuration Items (CIs) in the Configuration Management Database (CMDB). Link View shows how the attributes of the alerts in the group are linked with each other.") * [Alert links in network traffic-based alert groups](https://www.servicenow.com/docs/zQ59Wp~TsQBH2W907BlPwA "View the connections between alerts in network traffic-based alert groups in Express List by using Link View. Network traffic-based alert groups are created by analyzing network traffic connections between processes across hosts.") * [Alert links in log analytics-based alert groups](https://www.servicenow.com/docs/YhmkQx8SY1j7occ7E3188g "Use Link View in Express List to see why alerts in a log analytics-based alert group are correlated together through the visualization of shared attributes.") * [Viewing links between alerts in mixed alert groups](https://www.servicenow.com/docs/TWmNvU8qF3_Ipsdh3H54Jg "Link View displays the connections between alerts in mixed alert groups in Express List, including how alert attributes relate to each other within the group.") {#el-link-view__ul_nl4_qph_mbc} **Related tasks** * [View links between alerts in a group in Express List](https://www.servicenow.com/docs/SxHODPJLw~cEcds9UTBiCQ "Use Link View in Express List to view a visual representation of the relationships between alerts in a group.")