---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Alert actions

# Alert actions with an MCP Client {#ariaid-title1}

Release version: Australia  
Updated August 26, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Alert actions with an MCP Client

The Alert Actions tool enables ServiceNow users to manage ITOM alerts directly through an AI agent or MCP Client using natural language prompts.
It allows you to assign, close, reopen, acknowledge, and annotate alerts without leaving the MCP Client interface, streamlining alert investigation and response workflows.
Show full answer Show less  
This tool interacts with the Event Management Alerts table and supports both single-alert and bulk alert operations, depending on user roles and the scope of the alert handling needed.

## Key Features

* **Single-alert operations:** Users with the `evtmgmtoperator` role can manage individual alerts by assigning, closing, acknowledging, reopening, and adding notes or comments.
* **Bulk alert operations:** Users with the `evtmgmtadmin` role can perform actions on alert groups, such as reassigning, closing, and acknowledging multiple related alerts simultaneously for efficient team coordination.
* **Supported actions include:**
  * Assigning alerts to users or groups for proper routing.
  * Closing alerts when issues are resolved.
  * Reopening alerts if problems recur.
  * Acknowledging alerts to prevent duplicate escalations.
  * Adding internal work notes and public comments to record investigation details and facilitate collaboration.
* **Integration with ITOM MCP Server Console:** Actions requested in the MCP Client are authenticated and executed via the ITOM MCP Server Console, which provides confirmation and alert links for verification.
* **AI Interaction:** The tool uses AI-generated responses to process requests, so users should verify results and linked alerts after each action to ensure accuracy.

## Key Outcomes

* **Enhanced efficiency:** Manage alerts seamlessly within the MCP Client without switching to the ServiceNow Event Management UI.
* **Improved collaboration:** Facilitate coordinated team responses through bulk operations and shared notes or comments.
* **Real-time alert management:** Respond promptly to critical alerts by assigning, acknowledging, or updating alerts directly in chat.
* **Role-based control:** Ensure appropriate permissions govern single and bulk alert actions to maintain security and operational integrity.  
Manage alerts through an AI agent or MCP Client. The Alert Actions tool lets the agent or client act on alerts directly.

## Alert Actions tool overview {#itom-mcp-server-alert-actions__section_a2p_13j_jkc}

MCP tools retrieve data from your ServiceNow instance and perform alert actions.  
The Alert Actions tool enables you to assign, close, reopen, acknowledge, and annotate alerts through natural language prompts without leaving your MCP Client. The tool complements capabilities for retrieving and investigating alerts.  
Important:  
The Alert Actions tool acts on alerts through an AI agent or MCP Client. You're interacting with AI. AI-generated responses may be inaccurate or incomplete. Review the confirmation and the linked alert after each action to verify the result.

## Single vs. bulk alert operations {#itom-mcp-server-alert-actions__section_b5g_c2p_vjc}

The Event Management Alerts table represents both individual alerts and alert groups. The Alert Actions tool automatically detects the scope:  
* Single-alert operations act on one alert at a time. Typical for direct investigation and targeted response.Users with the evt_mgmt_operator role can perform single-alert actions. They can assign to self, close after
  investigation, acknowledge receipt, and add diagnostic notes.

* Bulk operations act on multiple related alerts (alert group) in a single request. Efficient for coordinated team response to widespread issues.Users with the evt_mgmt_admin role can perform bulk operations on alert groups.
  They can reassign multiple related alerts to the network team, close a batch of resolved alerts, and acknowledge a group of new alerts.

{#itom-mcp-server-alert-actions__ul_gxq_bfc_vjc}

Both modes support all actions described in the Supported actions section.

## Supported actions {#itom-mcp-server-alert-actions__section_hv1_x2p_vjc}

The Alert Actions tool supports the following operations on individual alerts and alert groups:{#itom-mcp-server-alert-actions__table_wkc_h2c_vjc__entry__2}

| Action | Description |
|-|-|
| Assign | Assign an alert to a user or group. Useful for routing work to the right team. |
| Close | Mark an alert as closed. Use when the underlying issue is resolved. |
| Reopen | Reopen a previously closed alert. Required if a closed alert recurs. |
| Acknowledge | Acknowledge receipt of an alert. Helps prevent duplicate escalations and signals active monitoring. |
| Add work notes | Add internal notes to an alert to record investigation details for other agents and operators. |
| Add comments | Add comments visible to other agents and operators working on the alert. |
[Table 1. Alert Actions tool supported actions]

{#itom-mcp-server-alert-actions__table_wkc_h2c_vjc}

## Use cases {#itom-mcp-server-alert-actions__section_o11_dfp_vjc}

The Alert Actions tool is useful in the following scenarios:  
* An operator investigates an alert in an MCP Client, identifies the root cause, and immediately closes it with a note---all in the chat.
* A manager receives a notification about critical alerts, lists them in the MCP Client, assigns the entire batch to the on-call engineer, and tracks confirmation in real time.
* An operator acknowledges time-sensitive alerts to help prevent duplicate escalations, without navigating to the ServiceNow Event Management UI.
{#itom-mcp-server-alert-actions__ul_kql_cfc_vjc}

## Workflow {#itom-mcp-server-alert-actions__section_iky_bfp_vjc}

The Alert Actions tool operates as part of the ITOM MCP Server Console workflow:

1. An operator or manager opens their MCP Client application and describes the action they need.

   For example: "Assign this alert to the network team".
2. The MCP Client sends the request to the ITOM MCP Server Console using the Model Context Protocol (MCP).
3. The ITOM MCP Server Console authenticates the user against ServiceNow role-based access control (RBAC).
4. The ITOM MCP Server Console performs the requested action on the alert record.
5. The ITOM MCP Server Console returns a confirmation to the MCP Client, including a deep link to the alert for verification in the UI if needed.
{#itom-mcp-server-alert-actions__ol_r4v_1fc_vjc}