---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Security incidents created from events and alerts

# Security incidents created from events and alerts {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Security incidents created from events and alerts

ServiceNow Event Management imports events from alert monitoring tools, groups them into alerts, and enables the creation of security incidents from these alerts.
Security incidents can be created automatically via alert rules or manually by security administrators, allowing efficient tracking and investigation of security-related events.
Show full answer Show less  

## Key Features

* **Automatic security incident creation:** Sample alert rules like "Create security incidents from critical alerts" automatically generate security incidents from critical security events sourced from ServiceNow or third-party monitoring tools.
* **Customizable alert rules and task templates:** Alert rules can be tailored with specific conditions to handle different types of security incidents, and task templates can be modified to set initial values for created incidents.
* **Manual incident creation:** Users with the Security Admin role can manually create security incidents from suspicious alerts by using the "Create Security Incident" button.
* **Event data requirements:** Events received from external tools should include key details such as the affected resource (node) identified by name, IP address, or sysid; event classification set to "Security"; event description; and additional information formatted as JSON to populate incident fields.
* **Field population logic:** Incident fields matching JSON field names are set only if they are empty; otherwise, existing values remain unchanged. All event details are recorded in work notes, unless no changes occur in the incident.
* **Support for custom fields:** Any fields, including custom fields added to the security incident table, can be populated from event data.

## Practical Benefits

This capability streamlines the process of converting security-related events into actionable security incidents within ServiceNow, improving incident response efficiency and ensuring critical alerts are promptly investigated. Customizable rules and templates provide flexibility to meet diverse security operational needs, while manual creation options empower security administrators to respond to suspicious alerts as they arise.  
As events are imported from alert monitoring tools, they are first processed by Event Management and grouped into alerts. These alerts can be used to create security incidents based on customizable
alert rules, or manually reviewed to select those alerts to be investigated as a security incident.

You can find a sample alert rule called Create security incidents from critical alerts in the Alert Rules module of the Event Management application. This alert rule automatically creates security incidents when critical
security-related events are received from within ServiceNow or from third-party monitoring applications. After the security incident has been created, it will be updated as new events are received. You can modify the task template in the alert rule to
change the initial values for the security incident created by this alert rule. To handle each distinct variety of security incident that you would like to create, you can define other alert rules with different conditions.

Alternatively, if you are a user with the Security Admin role, you can manually create a security incident by clicking the Create Security Incident button from any suspicious alert.  
It is important that the events received from external tools include the following information:

* The node set to the name, IP address, or sys_id of the CI that becomes the affected resource.
* The event classification is set to Security to distinguish them from other IT events.
* The event description, which populates the description of the security incident.
* The additional information can include any extra information that does not fit into the previously listed fields or other event fields, such as the category, attack vectors, return URL, or correlation ID. The format is a string that lists field names along with their values, using the following JSON format:

      { "fieldName" : "fieldValue", "fieldName" : "fieldValue" }

{#c_ScIncdUseAlrts__ul_bsw_pls_zs}  
Note:  
For each field and value pair, if the field in the security incident where the column name matches the fieldName is empty, it is set to the fieldValue. If the field in the security incident is not empty, it is not changed. In either case, the event and all the fields and values encoded in the additional information are recorded in a work notes entry describing the event. If nothing changes in the security incident, a work note entry is not created. Any fields in a security incident, including custom fields you add to the table, can be set.