---
sourceDocument: Xanadu IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/it-operations-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Tag cluster alert grouping

# Tag cluster alert grouping {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Tag cluster alert grouping enables you to easily create groups of alerts. It is a non-code method of alert grouping that correlates alerts without having to use CMDB or model training. This simpler way of grouping similar
alerts reduces the overall noise of a large quantity of alerts.

Tag cluster alert grouping is enabled immediately after the activation of the Tag-Based Alert Clustering Engine application, available in the ServiceNow Store. This grouping is applied according to the correlation logic order specified in the [Configure alert correlation logic order](https://www.servicenow.com/docs/Tz3PuvykLoBh0OSmQU1R4Q "Improve alert management by enabling users to customize correlation logic order. This feature empowers you to fine-tune correlation methods to their specific needs, enhancing alert prioritization and response efficiency."). Alert grouping tags are attached to definitions on a many-to-many (M2M) basis. Multiple tags can be linked to a single definition, and a tag can be part of multiple
definitions. Groups formed from tag cluster alert grouping definitions are classified as the Tag Cluster group type.

Tag cluster alert grouping supports domain separation, allowing different domains to have their own distinct alert grouping configurations and logic.

First, create alert grouping tags to define the criteria for grouping alerts. You can set the tags to require an exact match, an approximate ('fuzzy') match, or a character pattern match.

You can also use preconfigured tags to speed up alert clustering. These predefined tags are mapped from alerts and are based on information from sources such as the Alert field, Alert tags, or Alert additional info. If the required
data is missing and the selected tag source is Alert CI or Alert CI key, the tag is populated using the Configuration Item (CI) value from the Configuration Management Database (CMDB). Predefined tags are easily identified by their description, which includes 'out of the box.'

You can attach one or more tags to an alert clustering definition, which specifies the conditions for alert correlation. You can either create your own alert clustering definition or use a predefined one provided by the
application. Predefined definitions come with associated tags.  
Important:  
Make sure to activate predefined definitions before use. In new systems, several definitions are active by default. The remaining ones must be activated. For more information, see [Activate a predefined alert clustering definition](https://www.servicenow.com/docs/VpCsiF0jc36YmGHuVvR9bQ "Activate predefined alert clustering definitions provided with the Tag Based Alert Clustering Engine  application before use. Using these preconfigured definitions minimizes setup time.").

Once one or more alert clustering tags are attached to a definition, the system collects alerts and checks if their tags match all the tag values specified in the definition. Alerts with matching or similar tag values are grouped
together. New incoming alerts join an existing group if their tags match the tags in the definition used to create the group.

For tag-cluster grouping, alerts are added to a group based on the timeframe defined in the alert clustering settings. The time between the initial alert (virtual alert) and subsequent alerts is evaluated. If two new alerts are
received, and their time difference falls within the defined timeframe, they are added to the group. The initial event's generation time is used to determine the relevance of the timeframe.
**Related tasks**   

* [Create alert clustering tags](https://www.servicenow.com/docs/DfS3g7ONWi13Tqfe5F5UZQ "Alert clustering tags represent an improved way to correlate alerts. Alerts with identical or similar tags (depending on the configured match method) are joined together to form a group.")
* [Create an alert clustering definition](https://www.servicenow.com/docs/cO2gTRNiDS35OAQEjSVFSA "An alert clustering definition determines the conditions that must be met for invoking one or more alert clustering tags. Alert clustering tags enable you to create an alert group from fewer alerts.")
* [Activate a predefined alert clustering definition](https://www.servicenow.com/docs/VpCsiF0jc36YmGHuVvR9bQ "Activate predefined alert clustering definitions provided with the Tag Based Alert Clustering Engine  application before use. Using these preconfigured definitions minimizes setup time.")
* [Attach a predefined tag to a tag-based alert clustering definition](https://www.servicenow.com/docs/vlzPAwW1sHJFMB~xouarcQ "Get started faster with alert clustering by attaching a predefined alert clustering tag to a tag-based alert clustering definition in Event Management.")
* [Configure an event rule to customize alert content](https://www.servicenow.com/docs/UgXOiOdye5mIdEiHATmvrg "You can configure an event rule to customize alert content. You can customize the order of the fields and select which fields display. The fields in the left-hand work area of the Transform and Compose Alert Output section of an event rule are the fields that appear in the generated alert.")