---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Mixed alert grouping

# Mixed alert grouping {#ariaid-title1}

Release version: Australia  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Mixed alert grouping combines multiple strategies---currently CMDB-based, tag-based, related log entities-based, and shared impacted services-based grouping---to form a single, cohesive alert group. It reduces noise, bridges gaps
when one method isn't enough, and delivers a clearer, end-to-end view of incidents. This approach helps operators identify root causes faster and take informed action, even in complex or incomplete data environments.

To understand how Mixed grouping works in practice, it's important to look at the individual strategies it currently supports. At this stage, Mixed Grouping includes four core methods. CMDB-based alert grouping uses service
relationships defined in the CMDB. Tag cluster alert grouping uses shared metadata across alerts. Related log entities alert grouping correlates alerts based on associated log entities. Shared impacted services alert grouping
groups alerts that affect common services. Each method plays a distinct role in effectively correlating related alerts.

If you're looking to group alerts, see [Create Group automation](https://www.servicenow.com/docs/dzmFiicpe800NSz3XP_fGw "Grouping automation helps you manage alerts more effectively by collecting similar alerts together. This makes it easier to see patterns, quickly identify issues, and respond efficiently. By organizing alerts in this way, you can reduce alert noise, identify root causes, and assign them to the appropriate teams.").