--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Subflows in the base system # Event Management subflows in the base system {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Event Management subflows in the base system Event Management in ServiceNow Australia release provides a set of predefined subflows to automate alert remediation actions. These subflows appear in the Remediation Subflows section of alert management rules, enabling customers to automate responses such as acknowledging alerts, creating incidents, or closing alerts based on specific conditions. Show full answer Show less ## Accessing and Using Subflows To use these subflows, navigate to **Event Management \> Rules \> Alert Management Rules** and create or edit a rule. Under the **Actions** tab, you can add available subflows by searching in the Remediation Subflows area. Selecting a subflow inserts it as an automated action for the alert rule. ## Key Subflows and Their Functions * **Acknowledge Alert:** Marks an alert as acknowledged, signaling it requires attention. * **Attach Knowledge Article (legacy):** Attaches a knowledge article to alerts for instances migrated from pre-London releases. * **Change Alert to Maintenance Mode:** Sets the alert status to Maintenance. * **Close Alert:** Closes the alert. * **Create Incident:** Creates an incident using alert details, but skips if the alert is in Maintenance or an incident already exists. * **Create Major Incident Candidate:** Creates a major incident candidate from the alert; can be upgraded to a major incident. Not triggered if alert is in Maintenance or role is Secondary. * **Create Major Incident from Alert / with Impact:** Creates a major incident using alert data, optionally considering Impact. Also respects conditions about existing incidents, Maintenance mode, and role. * **Create Major Incident Candidate with Impact:** Similar to the candidate creation but includes Impact as input. * **Create Task (legacy):** Uses task templates for instances migrated from legacy releases. * **Overwrite Alert Template (legacy):** Applies alert templates for legacy instances. ## Important Notes for Customers * Incidents or major incident candidates are not created if the alert is in Maintenance mode or already linked to an incident. * Secondary alerts do not trigger creation of major incident candidates or major incidents. * Legacy subflows support instances upgraded from pre-London releases and require adding specific columns to the Alert Management Rules table. ## Customization and Automation Customers can customize these base subflows or create new custom subflows to tailor alert remediation to their business processes. Additionally, alert response automation can also be managed through the Service Operations Workspace by creating respond automations for a more user-friendly configuration experience. The subflows provided with the base system appear in the Remediation Subflows area of alert management rules. ## Accessing the subflows {#subflows-provided__section_mb5_123_4gb} Navigate to Event ManagementRulesAlert Management Rules and click New. Click the Actions tab. In the Remediation Subflows area, double-click the Insert a new row field. ![Specify subflow]() Click the search icon ![Search icon]() to add subflows. The list of subflows that are provided with the base system appears. {#subflows-provided__table_ffj_gwd_b2b__entry__2} | Name | Description | |-|-| | Acknowledge Alert | Subflow to mark the alert as being Acknowledged. Acknowledge an alert to show that further attention is required. | | Attach Knowledge Article (legacy) | Subflow to attach a knowledge article to the alert. This subflow is provided for instances that are migrated from legacy releases (prior to the London release). Note: Add the Knowledge article column to the Alert Management Rules \[em_alert_management_rule\] table, and select an article to attach to an alert when the rule executes. | | Change Alert to Maintenance Mode | Subflow to mark the alert as being in Maintenance. | | Close Alert | Subflow to mark the alert as being Closed. | | Create Incident | Subflow to create an incident. Fields from the alert are used to populate the matching fields in the incident that is created. Note: * If there is an existing incident that is attached to the alert, this subflow is not activated. * If the alert is in Maintenance, an incident is not created. * The alert management job runs even if the alert grouping job is not complete, if a specified time frame has passed. When this occurs, an incident already exists for the primary alert. You can enable the Avoid INTs on secondary alerts rule to prevent incidents from being created for secondary alerts when the evt_mgmt.avoid_int_enabled property is enabled. {#subflows-provided__ul_amh_d32_b2b} | | Create Major Incident Candidate | Subflow to create a major incident candidate. Fields from the alert populate the matching fields in the major incident candidate that is created. A major incident candidate can be upgraded to become a major incident. Note: * If there is an existing incident that is attached to the alert, this subflow is not activated. * If the alert is in Maintenance, a major incident candidate is not created. * If the Role in group is Secondary, the major incident candidate is not created. {#subflows-provided__ul_ocz_tg5_lhb} | | Create Major Incident from Alert | Subflow to create a major incident from alert. Fields from the alert are used to populate the matching fields in the major incident that is created. Note: * If there is an existing incident that is attached to the alert, this subflow is not activated. * If the alert is in Maintenance, an incident is not created. * If the Role in group is Secondary, the major incident candidate is not created. {#subflows-provided__ul_irz_wg5_lhb} | | Create Major Incident with Impact | Subflow to create a major incident from an alert in which the Impact field is also taken as input. Fields from the alert are used to populate the matching fields in the major incident that is created. Note: * If there is an existing incident that is attached to the alert, this subflow is not activated. * If the alert is in Maintenance, an incident is not created. * If the Role in group is Secondary, the major incident candidate is not created. {#subflows-provided__ul_ayn_4s4_llb} | | Create Major Incident Candidate with Impact | Subflow to create a major incident candidate in which the Impact field is also taken as input. Fields from the alert populate the matching fields in the major incident candidate that is created. A major incident candidate can be upgraded to become a major incident. Note: * If there is an existing incident that is attached to the alert, this subflow is not activated. * If the alert is in Maintenance, a major incident candidate is not created. * If the Role in group is Secondary, the major incident candidate is not created. {#subflows-provided__ul_gfx_xs4_llb} | | Create Task (legacy) | This subflow uses a task template, if provided, or the EventMgmtCustomIncidentPopulator script for instances migrated from legacy releases (prior to the London release). If configured, apply the task template. Note: Add the Task template column to the Alert Management Rules \[em_alert_management_rule\] table, and select a task template and task to apply when the rule executes. | | Overwrite Alert Template (legacy) | This subflow applies the alert template. This subflow is provided for instances that are migrated from legacy releases (prior to the London release). Note: Add the Task type column to the Alert Management Rules \[em_alert_management_rule\] table, and select an alert template to apply when the rule executes. | [Table 1. Subflows in the base system] {#subflows-provided__table_ffj_gwd_b2b} 1. Select the subflow that you need. 2. To customize a subflow, see [Create a custom subflow for alerts](https://www.servicenow.com/docs/W77MQPhfUD3eUEQIWHSlDw "You can create a subflow according to your requirements. For example, you can resolve alerts, notify teams, or run remediation actions."). This topic also describes the input parameters in a subflow. 3. To specify when the workflow must be executed, double-click the cell under Execution. . {#subflows-provided__ol_szd_jvx_vgb} To automate alert responses with an easier interface, you can also create a respond automation in Service Operations Workspace. For more information, see [Create Respond automation](https://www.servicenow.com/docs/f3d~fy1dqmKujs2i4aUc9A "Respond to alerts automatically by notifying appropriate stakeholders, escalating them as needed based on severity and type, or other executing response actions. This process ensures that alerts are managed promptly and effectively."). *[\>]: and then