---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Investigate alerts

# Investigate alerts using an MCP Client {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the ITOM
MCP Server Console to investigate alerts through an MCP Client application, such as Moveworks or AWS Claude.

## Before you begin

For more information about the Alert Investigation tool, see.

Role required: evt_mgmt_admin, evt_mgmt_operator

## Procedure

1. Open your MCP Client application, such as AWS Claude, that is connected to your ServiceNow instance using the ITOM MCP Server Console.  
   Your system administrator configures this integration during setup.
2. Ask the AI tool a question about an incident.  
   Use natural language to ask questions. Here are common types of prompts:
   * Retrieve a list of alerts for today: "List alerts created today."
   * List only critical alerts: "List only the critical alerts created today."
   * Analyze and investigate the alerts: "Analyze and investigate the alerts."  
     Note:  
     Information returned through alert analysis may include several lines of text per alert.
   * Analyze a specific alert: "Analyze Alert 00100032."
   {#review-alerts-using-itom-mcp-server__prompt-examples}
3. Review the MCP Client application response.  
   The MCP Client application retrieves data from your ServiceNow instance and presents it in the chat. The response includes only data you have permission to access.
{#review-alerts-using-itom-mcp-server__steps_hxf_gmm_bjc}