---
sourceDocument: Xanadu IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/it-operations-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Operator phase 2: Triage an alert

# Operator phase 2: Triage an alert {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

After you analyze and acknowledge an alert, you must triage it. The triage phase
involves verifying alert correlation and taking an action to help resolve the
issue that caused the alert. This topic covers the most common triage task: creating an
incident from an alert.

## Before you begin

Note:  
The Operator Workspace interface is available only to customers who have upgraded from a release prior to the Utah release. New customers as of the Utah release can use the Service Operations Workspace for ITOM, which offers an enhanced UI for managing alerts.  

|-|-|-|
| Phase 1 | ![Analyze icon]() | [Analyze and acknowledge an alert](https://www.servicenow.com/docs/nB533tkvWUfqcnY5edwYqg "As an Event Management operator, the first thing you should do is access alerts and then find the ones you want to focus on. You can open the Alert form to analyze the details, and then acknowledge it to let other operators know that the issue causing the alert should be addressed in some way.") |
| Phase 2 | ![Triage icon]() | Triage alerts |
| Phase 3 | ![Close alert icon]() | [Close an alert](https://www.servicenow.com/docs/2aQK4y4jYDuH5fN7IzW0Sg "After you take action on an alert, you can verify several items on the alert and then close it.") |
[ ]

{#operator-phase-triage-incident__table_pp3_vg3_3db}

Role required: evt_mgmt_operator

## Procedure

1. Before you start to work on the alert, check whether other alerts should be correlated with the one you just reviewed:
   1. Navigate to Event ManagementService Operations Workspace.
   2. Click the same application service tile and review the alerts in the Alerts list.
   3. If multiple alerts are present, open one to determine if it is related to the other alert, or if the underlying issue is the same in both alerts.  
      For example, if an alert is associated with a web server and there is already an alert for the database issue, correlate the web server alert as a secondary alert with the database alert as the primary alert.
   4. Open the secondary alert, click the lookup icon (![Lookup icon]()) in the Parent field, and then select the primary alert.  
      This creates a primary (parent) / secondary (child) relationship between the two alerts.  
   5. Repeat this process to correlate as many secondary alerts as necessary.
   6. Navigate back to the Service Operations Workspace dashboard and verify that the primary alert displays an icon in the Group column.  
      Note:  
      Your administrator can set up rules that let the system automatically correlate alerts so that you do not need to do so manually. In that case, a Feedback field appears on the Alert form. Select Yes if the system correlated the alert correlated correctly, or No if not. Currently, the feedback option is available but does not trigger further actions after being logged.
   {#operator-phase-triage-incident__substeps_lt5_cpy_hdb}
2. Open the primary alert.
3. On the Alert form, click ActionsCreate Incident.  
   If your organization uses Security Incident Response, the button is Create Security incident.  
   The Flow Designer opens.
4. Click Refresh.  
   The Execution Details page opens.
5. Click Open Context Record and then fill in the Incident form.  
   {#operator-phase-triage-incident__table_z1h_ntr_fdb__entry__2}

   | Field | Description |
   |-|-|
   | Caller | Click the lookup icon (![Lookup icon]()) and then select your name. The caller is the person who discovered the issue that led to the incident. |
   | Category and Subcategory | Select a category that best describes this alert. In this example, Database is the best choice. |
   | Application service | Select the application service to which the CI belongs. In this example, the application service is Web portal. |
   | Configuration item | If it is not already populated, select the CI. In this example, the Oracle database (PS ORA01) is automatically populated into the field. |
   | Impact and Urgency | Select the impact and urgency levels that you think appropriate. |
   | Assignment group Assigned to | Click the lookup icons (![Lookup icon]()) for both or either of these fields, and then select the group or the individual that can handle the issue. |
   [ ]

   {#operator-phase-triage-incident__table_z1h_ntr_fdb}
6. Click Submit to create the incident.  
   The Alert you are working on reappears. On the Alert form, the incident is populated in the Task field. You can also see the incident number in the Task column on the Service Operations Workspace dashboard.

## What to do next

There are other tasks you perform as part of the triage stage:

* [Run a remediation workflow on an alert](https://www.servicenow.com/docs/CY8KjTu3NI1Hhvzmz6opWw "As an Event Management operator, you can also run a workflow on your ServiceNow instance that helps remediate the alert. For example, you might run a workflow that automatically restarts a server on your network, which might resolve an alert about CPU usage.") if your Event Management administrator already set up a workflow in your ServiceNow instance and your policies allow you to trigger it from the alert.
* [Launch a web application from an alert](https://www.servicenow.com/docs/tN~jNbaNlVFWl6pATwAOlg "As an Event Management operator, you can also launch a web application from an alert. The web application might be a console for the event monitoring tool that your organization uses, or any external website that provides additional information you might need about the alert.") to open a website or an event monitoring tool that provides more information about the alert.
* [Associate a knowledge base article with an alert](https://www.servicenow.com/docs/d_3YEOte~KjrPUB0QgSWEw "As an Event Management operator, you can associate a knowledge base (KB) article with the alert to capture additional information about the alert. This might include a procedure that someone has to follow to resolve the underlying issue on your network, or a best practice to prevent the issue from reoccurring.") if there is existing information about the alert that might help resolve the underlying issue.
* [Put an alert into maintenance](https://www.servicenow.com/docs/J8mFdfnHY61F2bleawzTOA "As an Event Management operator, you can put an alert into maintenance if the alert does not require any further action, but you still want to keep the alert active. Putting the alert into maintenance hides it from the Service Operations Workspace dashboard so that other operators do not need to access it, but it does not close the alert.") to temporarily hide it from the Service Operations Workspace dashboard if the alert does not require action at this time.
{#operator-phase-triage-incident__ul_ktk_3tj_hdb}

If you do not need to perform any other triage actions, proceed to [Phase 3: Close an
alert](https://www.servicenow.com/docs/2aQK4y4jYDuH5fN7IzW0Sg "After you take action on an alert, you can verify several items on the alert and then close it.").
* **[Run a remediation workflow on an alert](https://www.servicenow.com/docs/CY8KjTu3NI1Hhvzmz6opWw)**   
  As an Event Management operator, you can also run a workflow on your ServiceNow instance that helps remediate the alert. For example, you might run a workflow that automatically restarts a server on your network, which might resolve an alert about CPU usage.
* **[Launch a web application from an alert](https://www.servicenow.com/docs/tN~jNbaNlVFWl6pATwAOlg)**   
  As an Event Management operator, you can also launch a web application from an alert. The web application might be a console for the event monitoring tool that your organization uses, or any external website that provides additional information you might need about the alert.
* **[Associate a knowledge base article with an alert](https://www.servicenow.com/docs/d_3YEOte~KjrPUB0QgSWEw)**   
  As an Event Management operator, you can associate a knowledge base (KB) article with the alert to capture additional information about the alert. This might include a procedure that someone has to follow to resolve the underlying issue on your network, or a best practice to prevent the issue from reoccurring.
* **[Put an alert into maintenance](https://www.servicenow.com/docs/J8mFdfnHY61F2bleawzTOA)**   
  As an Event Management operator, you can put an alert into maintenance if the alert does not require any further action, but you still want to keep the alert active. Putting the alert into maintenance hides it from the Service Operations Workspace dashboard so that other operators do not need to access it, but it does not close the alert.

*[\>]: and then