---
sourceDocument: Xanadu IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/it-operations-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Configure alert remediation actions

# Configure alert remediation actions {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Run commands to perform alert remediation on remote Linux and Windows CIs.

## Before you begin

Install the following plugins:

* IntegrationHub Enterprise spokes plugin
* ServiceNow IntegrationHub Action Step - PowerShell
* ServiceNow IntegrationHub Action Step - SSH
{#configure-alert-remediation-subflows__ul_er2_rgy_rfc}

For Linux: Ensure that the remote Linux host is
reachable using the MID Server IP address that runs action
scripts.  
For Windows:

* Ensure that Powershell v3.0 - 5.0 are supported and installed on the Windows target server.
* Enable Powershell remoting on the remote Windows target server.
* Ensure that the remote Windows target server is reachable using the FQDN from the MID Server that runs action scripts.
{#configure-alert-remediation-subflows__ul_ts2_nqm_f5b}  
Add credentials to the credential aliases that come with the base system:

* linuxAdmin
* windowsAdmin
{#configure-alert-remediation-subflows__ul_ddv_5qp_g5b}

Role required: evt_mgmt_admin or flow_designer

## Procedure

1. Access remediation actions in one of the following ways:  
   * Quick actions in an alert, as described in [Apply a quick response in an alert](https://www.servicenow.com/docs/C34jXP~_3X8S90Yzt9KAkw "In an alert, use the Quick Response feature to apply remediation to the alert or to launch a web application.").
   * The Playbook tab in Service Operations Workspace, as described in [Run actions to
     resolve alert issues](https://www.servicenow.com/docs/T3xGG5qWkwSKExPX7WSj4w "Resolve the underlying issue of an alert by running predefined remediation tasks, ensuring faster issue resolution and ensuring consistent resolution.") .
   {#configure-alert-remediation-subflows__ul_djw_yjn_f5b}
2. Configure additional input in the alert's Additional Information field, using this format:  
   `{"remediation_action_resource":"<mandatory input>"}`

   The mandatory input per action is described in the following table.
   {#configure-alert-remediation-subflows__table_js4_zkn_f5b__entry__2}

   | Action name | Mandatory input in Additional information field |
   |-|-|
   | Stop Windows Process | Process ID |
   | Restart Linux Service | Service Name |
   | Kill Linux Process | Process ID |
   | Get Windows Processes | N/A |
   | Stop Windows Service | Service Display Name |
   | Restart Windows Service | Service Display Name |
   | Get Windows Services | N/A |
   | Stop Linux Service | Service Name |
   | Start Windows Service | Service Display Name |
   | Suspend Windows Service | Service Display Name |
   | Get Linux Services | N/A |
   | Run Linux Top for Memory | N/A |
   | Show Disk Space Used | N/A |
   | Run Linux Top | N/A |
   | Start Linux Service | Service Name |
   | Show Disk Space Used | N/A |
   [ ]

   {#configure-alert-remediation-subflows__table_js4_zkn_f5b}
{#configure-alert-remediation-subflows__steps_q41_yjn_f5b}

## Result

After executing an alert action, the results are noted in the Work Notes field of the alert.
**Related topics**   

* [Troubleshooting WMI/Powershell issues on the remote machine](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0549830)
* [WMI, PowerShell, and Windows Firewalls](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0549828)
* [MID Server: troubleshooting WMI/Powershell issues - Credentials](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0549834)
* [How to Enable/Test PowerShell Remoting on Windows Host](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0813330)