---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Network traffic based alert grouping

# Network traffic based alert grouping {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Network traffic based alert grouping

The Network traffic based alert grouping method in ServiceNow groups alerts by analyzing network traffic connections between processes across hosts.
It uses service candidates identified by ML Service Mapping to group alerts related to network traffic issues, providing a contextual view of network incidents by grouping alerts from directly connected processes within the same service candidate.
Show full answer Show less  
Service candidates represent potential collections of processes within your IT environment that are identified based on network interactions, even if configuration details are incomplete. ML Service Mapping uses machine learning to automatically discover and map these service candidates, helping to organize IT services and their components for easier management and troubleshooting.

This grouping method is enabled by default for new customers starting with the Australia release. Existing customers can enable it manually by setting the property **Enable Network Traffic correlation (saanalytics.agg.querynetworktrafficcorrelationenabled)**.

## How it works

* **Host identification:** Alerts related to network issues are generated from various sources.
* **Network context identification:** The correlation process uses horizontal discovery results and ML Service Mapping to identify relevant service candidates and network connections. This relies on a scheduled daily job, *Event Management - Populate Service candidate process to process mapping - Daily*, which stores process-to-process connections for Host CIs in a format suitable for alert grouping.
* **Alert grouping:** Alerts are grouped based on direct process-to-process connections within the same service candidate. Grouping updates in real-time as new alerts arrive.

## Benefits

* **Improved accuracy:** Leveraging network traffic connections and service candidates reduces false positives in alert grouping.
* **Enhanced coverage:** Effectively groups alerts even in environments with low CMDB maturity, covering a broader range of issues.
* **Streamlined resolution:** Enables IT teams to identify and resolve related issues collectively, reducing alert volume and improving operational efficiency.  
The Network traffic based alert grouping method groups alerts by analyzing network traffic connections between processes across hosts. It leverages service candidates identified by ML Service Mapping to group alerts related to
network traffic issues. This ensures alerts from directly connected processes within the same service candidate are grouped together, offering a more contextual view of network incidents.

Service candidates are potential collections of processes within your IT environment that are identified based on their network connections and interactions. They represent different services or functions that your IT systems provide,
even if they are not fully detailed in your system's configuration database. For example, service candidates might group together all the processes involved in email delivery, even if the configuration details are incomplete.

ML Service Mapping uses machine learning to automatically discover and map out these service candidates. It identifies how different processes and components are connected and grouped together based on their network traffic and
interactions. This helps in understanding and organizing the IT services and their components, making it easier to manage and troubleshoot issues. For example, ML Service Mapping might automatically identify and map the connections
between email servers and mail clients based on their network interactions.  
Note:  
Network traffic based alert grouping is enabled for new customers starting with the Australia release. Existing customers need to enable the property Enable Network Traffic correlation (sa_analytics.agg.query_network_traffic_correlation_enabled) manually.

## How it works {#network-traffic-correlation-grouping__section_xzm_hff_scc}

* Host identification: Alerts related to network issues are generated from various sources.
* Network context identification: The correlation process uses horizontal discovery results and ML Service Mapping to identify the most relevant service candidates and network connections.This process uses the results of the
  scheduled job Event Management - Populate Service candidate process to process mapping - Daily, which runs once a day. The job stores process-to-process connections for Host CIs in the format required by the alert grouping algorithm.

* Alert grouping: Alerts are grouped based on direct process-to-process connections within the context of the same service candidate. Grouping is updated in real-time as new alerts are received.
{#network-traffic-correlation-grouping__ul_rj2_jff_scc}

## Benefits {#network-traffic-correlation-grouping__section_rtp_mff_scc}

* Improved accuracy: By leveraging network traffic connections and service candidates, this method provides high accuracy in grouping alerts, minimizing false positives.
* Enhanced coverage: It effectively groups alerts even in environments with low CMDB maturity, covering a broader range of alerts and issues.
* Streamlined resolution: IT teams can quickly identify and resolve related issues in bulk, reducing the volume of alerts to manage and improving operational efficiency.
{#network-traffic-correlation-grouping__ul_b15_4ff_scc}