---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Remediate alerts

# Remediate alerts with an MCP Client {#ariaid-title1}

Release version: Australia  
Updated August 24, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Get and execute an alert remediation workflow or suggestion through an MCP Client.

## Before you begin

Verify that:

* The ITOM MCP Server Console is active on your ServiceNow instance.
* Your MCP Client application is connected to the ITOM MCP Server Console with valid OAuth credentials.
* The alert you want to remediate has been investigated, either by the AI Specialist or through the Alert Investigation tool.If the alert has not yet been investigated, initiate an
  investigation using the Alert Investigation tool. For more information, see [Investigate alerts using an MCP Client](https://www.servicenow.com/docs/TuNUjoyKuf54ktW9zOOfQg "Use the ITOM MCP Server Console to investigate alerts through an MCP Client application, such as Moveworks or AWS Claude.").

{#itom-mcp-server-remediate-alert__ul_xxv_p3c_vjc}  
Warning:  
The Alert remediation tool provides suggestions through an AI agent or MCP Client. You're interacting with AI. AI-generated responses may be inaccurate or incomplete.

For more information about the Alert remediation tool, see [Alert remediation with an MCP Client](https://www.servicenow.com/docs/mi55bjQIrDHPo40SsGPfTg "Get remediation suggestions for an alert from an AI agent or MCP Client, matching what's available in Service Operations Workspace.").

Role required: evt_mgmt_operator or evt_mgmt_admin

## Procedure

1. Open your MCP Client application.
2. Ask the MCP Client how to handle a specified alert, using natural language.  
   Either the recommended remediation workflow for the alert is returned, or if none is available, a remediation suggestion is returned.
3. Confirm whether to execute or dismiss the recommendation.  
   If you confirm, the remediation is executed.
4. If the remediation fails to execute, confirm whether to proceed with the fallback action.  
   For example, creating an incident.