--- sourceDocument: Brazil IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Alert automation in SOW for ITOM # Alert automation in Service Operations Workspace for ITOM {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Alert Automation in Service Operations Workspace for ITOM Alert automation in Service Operations Workspace for ITOM addresses the growing volume and complexity of IT alerts by automating alert handling processes. Manual management is slow and error-prone, while automation improves mean time to resolve (MTTR), enhances service reliability, and optimizes staff efficiency. The system supports both centralized administrators and distributed teams, enabling qualified users such as site reliability engineers (SREs) to create and manage their own alert automations without impacting other teams. Show full answer Show less The alert automation interface offers an improved user experience compared to the classic interface, supporting event rules, tag-based clustering, and alert management. Both interfaces share the same backend data, so changes in one are reflected in the other. However, some advanced features remain exclusive to the classic experience for administrators. ## Alert Automation Types * **Ignore Automation:** Filters out irrelevant or false-positive alerts to reduce alert fatigue and focus attention on critical issues. * **Enrich Automation:** Adds contextual information to raw alerts, normalizes data, and standardizes formats to improve alert correlation and automated responses. * **Group Automation:** Clusters related alerts into a single primary alert to reduce noise and help identify root causes. * **Create Respond Automation:** Automatically notifies stakeholders, escalates alerts based on severity or type, and triggers remediation actions or integrations with third-party systems for case creation or notifications. ## Alert Automation Process Flow Alerts and events are ingested into ServiceNow via integrations configured in the Integrations Launchpad, which connects ServiceNow with monitoring tools. Upon receipt, alert automations run sequentially: 1. **Ignore:** Filters out noise and irrelevant alerts. 2. **Enrich:** Adds necessary context and normalizes alert data for better correlation and resolution. 3. **Group:** Consolidates related alerts to reduce volume and highlight root causes. 4. **Respond:** Escalates alerts, notifies stakeholders, and executes remediation workflows. Each automation type can have multiple automations triggered by specific conditions and actions, but automations apply only to new incoming alerts, not historical data. ## Benefits for ServiceNow Customers * Significantly reduce alert noise and manage alert fatigue effectively. * Improve MTTR by enriching alerts with relevant context and grouping related alerts. * Enhance service reliability with timely escalation and automated remediation. * Allow distributed teams to manage their alert automations independently, increasing operational agility. * Leverage integrations to unify monitoring and incident response workflows. Alert automation is crucial as organizations deal with increasing number of alerts and complex IT infrastructures. Manual alert handling is slow, error-prone and inefficient, underscoring the need for automated systems. Automation can improve the mean time to resolve alerts, improve service reliability and better scale staff resources. Alert automations also support both centralized administrator and distributed team roles. This enables qualified teams to self-serve and create their own alert automations. For example, you may consider granting access to site reliability engineers (SREs). Members of teams can manage automations for their own team and their own alerts without impacting other teams. For users familiar with our classic experience, alert automation offers an easier user interface and better team support for event rules, tag-based clustering definitions and alert management rules. Some advanced features are currently only available to admins in the classic experience. These two experiences use the same backend tables. You can use whichever experience is most convenient, and changes in one will also update the other. ## Alert automation types {#sow-itom-alert-automation__section_k2s_dhz_lbc} Currently, Service Operations Workspace ITOM provides the following types of automation. 1. [Ignore automation](https://www.servicenow.com/docs/2vGPmqiB_MmLcy877la8hg "Ignore automation streamlines the process of disregarding irrelevant or false-positive alerts from monitoring systems, efficiently managing alert fatigue by filtering out unnecessary notifications. As a result, teams can prioritize and resolve critical issues more effectively."): Reduce irrelevant or false-positive alerts, efficiently manage alert fatigue by filtering out noisy notifications, and allow teams to focus on critical issues. 2. [Enrich automation](https://www.servicenow.com/docs/sxzwlcQ2n4ew7eLBl6ngzw "Alert enrichment involves transforming raw events from monitoring tools into a standard format, aiding automated grouping and response. This includes extracting fields from lengthy alert payloads or composing them into a standardized format. Additionally, you can create tags, which are metadata added to alerts for easier filtering and grouping."): Enhance raw alerts with contextual information to make them more informative and actionable. In simple terms, this involves taking the raw events generated by monitoring tools and transforming them into a common and standard format to aid automated grouping and response. 3. [Group automation](https://www.servicenow.com/docs/OM3oKI7Rry_Wahava5K1Kw "Grouping automation helps you manage alerts more effectively by collecting similar alerts together. This makes it easier to see patterns, quickly identify issues, and respond efficiently. By organizing alerts in this way, you can reduce alert noise, identify root causes, and assign them to the appropriate teams."): Group multiple related alerts into a single primary alert to reduce alert noise and identify the root cause. 4. [Create Respond automation](https://www.servicenow.com/docs/5eh7Q_LMMEXuTF1BVhB~XA "Respond to alerts automatically by notifying appropriate stakeholders, escalating them as needed based on severity and type, or other executing response actions. This process ensures that alerts are managed promptly and effectively."): Respond to alerts automatically by notifying appropriate stakeholders, escalate them as needed or run remediation actions. Determine how and when alerts are escalated based on severity or type. Integrate with third-party systems to create cases, notifications or run remediation actions. {#sow-itom-alert-automation__ol_wb5_2hz_lbc} ## Alert automation process flow {#sow-itom-alert-automation__section_fd3_dhz_lbc} You may start by sending alerts or events from monitoring systems to ServiceNow using the Integrations Launchpad. This is where administrators establish connections between ServiceNow and monitoring tools. These integrations enable the collection of monitored data, generating events from third-party sources. When alerts are received by ServiceNow, alert automations run in the order shown on the page. First, we ignore alerts to reduce noise. Next, we enrich alerts with extra context, then group the alerts using the added context. Finally, we respond to alerts by escalating or running remediations. There can be several automations for each type. Each automation runs based on specific trigger conditions and executes specific actions. Alerts are only automated when they are received; we do not apply automations to past alerts. In the alert enrichment phase, administrators add or extract necessary fields from alerts to provide essential information for swift resolution. This ensures that alerts contain all relevant details required for effective incident response. Administrators add context to alerts by modifying and normalizing them. This enhances the correlation of alerts, making it easier to identify patterns and potential threats. The enriched and composed alerts are then grouped based on predefined criteria, consolidating related alerts. This reduces alert fatigue and facilitates efficient remediation. Finally, escalated alerts trigger notifications to stakeholders through various channels, ensuring timely communication and response to critical alerts. The following diagram illustrates this process flow.Figure 1. Alert automation: Reducing noise and improving resolution time This comprehensive alert automation process can reduce alert noise, improve mean time to resolution (MTTR), enhance service reliability, and boost staff productivity.