---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Create an incident from an alert

# Create an incident from an alert in Express List {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create an incident from an alert directly from the Express List pane, saving you the time and effort of navigating to the incident record.

## Before you begin

Role required: evt_mgmt_operator, evt_mgmt_admin  
Note:  
The evt_mgmt_user role is view-only and doesn't have permission to perform this action.

## Procedure

1. Navigate to WorkspacesService Operations Workspace.
2. From the navigation bar, select the Express list icon ![]().
3. Create an incident from a selected alert.
   1. In the Express List pane, select the check box for the desired alert.  
      Note:  
      To display the individual alerts inside a group, select the chevron icon (![Chevron icon.]()) at the beginning of the alert group row.
   2. Select the Alert actions drop-down list.  
      ![Alert actions drop down arrow]()
   3. Under Response actions, select Create Incident.

   {#open-incident__substeps_pv2_j1c_mhc}  
   An incident is created from the selected alert and a confirmation message is displayed.
{#open-incident__steps_ijj_m11_dzb}

*[\>]: and then