Review alerts

Access the Express List interface to review and manage alerts in your Event Management system.

Before you begin

Verify that you have installed the ITOM AIOps and Now Assist for IT Operations Management (ITOM) plugins.

Ensure you are in the Configure IT Operations Management page.

Role required: evt_mgmt_admin or evt_team_operator

About this task

When reviewing alerts, validate the following to ensure your event pipeline is healthy and alerts are actionable:

• Check CI binding. Alerts should populate the cmdb_ci field. If there is no CI, your binding rules need tuning.
• Verify severity spread. If everything lands as Critical or Info, your mapping needs work.
• Confirm that clear events close alerts. Trigger a condition, then resolve it at the source. The alert should auto-close.
• Spot-check key fields. Ensure node, source, resource, and message_key are meaningfully populated (not blank or generic).
• Review Error events. Check em_event status = Error for parsing or mapping issues.
• Check the alert count. Make sure it matches in both your source system and in ServiceNow.

Procedure

1. Navigate to Configuration Summary > Event Management > Alert response.
2. Expand Alert response.
3. Select Review alerts.
4. Select Review alerts in Express List.
   Express List opens with a list of active alerts.

   Note:

   To get more information on alerts so you can more efficiently monitor systems and services,​ resolve alerts, evaluate the alert impact,​ track issues, and report incidents, see Express List in the Service Operations Workspace for ITOM.
5. To complete the setup, select Mark as configured.