--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-yokohama-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zy bundleId : - delta3zy --- # Combined Event Management release notes for upgrades from Yokohama to Zurich # Combined Event Management release notes for upgrades from Yokohama to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 11 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Event Management Release Notes for Upgrades from Yokohama to Zurich This consolidated release note provides ServiceNow customers with detailed information about upgrades and enhancements in Event Management from the Yokohama release to the Zurich release. It highlights new features, changes, deprecations, and important upgrade considerations to help you prepare for and optimize your upgrade experience. Show full answer Show less ## Key Features * **Automated and Manual Response Enhancements:** Starting in Yokohama 26.7.0, you can execute response subflows automatically, manually, or both for alerts using the "Run Other Response Actions" option, improving control over automated responses with configurable execution limits. * **Improved Configuration Item (CI) Identification:** Link CIs to alerts for more accurate IT component mapping to enhance alert visibility and speed up issue resolution. * **Network Traffic-Based Alert Grouping:** Correlate alerts on host CIs based on discovered TCP connections and ML Service Mapping, enabling efficient grouping and visualization of alert connections via Express List® and Link View. * **Team-Level Operator Role:** The new `evtteamoperator` role allows operators to manage Event Management within their teams, including alert management, configuration changes, and integration setup through the Integrations Launchpad. * **Centralized ITOM AIOps Configuration Center (Zurich 26.11.0):** Manage AIOps settings centrally to integrate monitoring tools, optimize alerts, and manage dashboards, teams, and authorizations for enhanced operational efficiency. * **Incident Creation Delay:** Add delays before incident creation from alerts to allow auto-closure of resolved alerts and reduce unnecessary incidents. * **Expanded Metric Connectors (Zurich 2.17.1):** New and enhanced connectors for Dynatrace, Datadog, Kafka (with OAuth authentication), Nagios, SolarWinds, and Zabbix enable seamless metric integration into ServiceNow Metric Intelligence for visualization, anomaly detection, and alerting. * **ITOM Event Management Guided Setup:** Introduced in Zurich 27.2.1, this guided setup simplifies installation and initial configuration for faster onboarding. * **Improved User Experience in Service Operation Workspace:** Live update toggles for alert lists, new Dependency view for alerts, ability to respond to multiple alerts simultaneously, and enhanced alert group visualization. * **Mixed Alert Grouping:** Combine CMDB-based and tag-based grouping strategies to reduce alert noise and improve response effectiveness. * **AIOps 360 Overview Dashboard:** Provides comprehensive insights into product value, operational efficiency, and automation impact to drive informed IT operations decisions. * **Automatic Regex Generation:** Automates extraction of event field content into alert fields, reducing manual effort and improving data accuracy. * **Coral Theme:** The new default theme for portals, web, and mobile experiences offers a modern, brand-neutral look with optional dark mode for enhanced user experience. ## Changes * Several property names related to alert aggregation and CMDB correlation were renamed for clarity and consistency. * Pull connectors now have the "Apply additional matching rules" option enabled by default for out-of-the-box event rules, simplifying setup. * Group automation supports grouping by impacted service instances and related log properties, with enhanced test automation reporting for better visibility and validation. * Validation of CI identification in Enrich Automation ensures accurate matching by checking CI attributes on alerts. ## Deprecations * The `emalertlistsautorefresh` table no longer controls live alert list updates; use the new `sysuxlist` property instead. * Event Management connector upgrades deprecate unused V1 connector definitions. * The vRealize event connector now uses a JSON-based API instead of the deprecated XML API to maintain future compatibility. ## Activation and Additional Information Event Management continues to be activated via the `com.glideapp.itom.snac` plugin. The product is available through the ServiceNow Store. There are no new browser, localization, accessibility, or additional requirements introduced between Yokohama and Zurich releases. ## Practical Benefits for ServiceNow Customers * Enhanced automation and alert grouping reduce noise and accelerate incident response. * Centralized management and guided setup streamline configuration and improve operational efficiency. * Expanded integrations with popular monitoring tools simplify metric ingestion and anomaly detection. * Improved user roles and UI enhancements empower team-level operators and provide better alert visibility. * Flexibility to delay incident creation and automate regex extraction reduces manual overhead and prevents unnecessary work. * A modern UI theme and dashboard enhancements improve overall user experience and insight delivery. Consolidated page of all release notes for Event Management from Yokohama to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Event Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Event Management to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-eventmanagement-summary__entry__2} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## New features Between your current release family and Zurich, new features were introduced for Event Management. {#dfrn3-eventmanagement-summary__entry__8} | Release | Release notes | |-|-| | Yokohama | [\[Placeholder link text to key esc-notify-alert-sow-itom\]](https://www.servicenow.com/docs/access?context=esc-notify-alert-sow-itom&family=yokohama&ft:locale=en-US) : Starting in version 26.7.0, execute response subflows automatically, manually, or both for alerts that match specific conditions through the Run Other Response Actions option of Respond Automatic. This enhancement offers better control over automated responses with configurable execution limits and multiple response actions. [\[Placeholder link text to key enrich-alert-sow-itom\]](https://www.servicenow.com/docs/access?context=enrich-alert-sow-itom&family=yokohama&ft:locale=en-US) : Starting in version 26.7.0, link a CI to an alert for more accurate IT component mapping though the Improve Configuration Item (CI identification option of Enrich Automation. This enhancement improves alert visibility, speeds up issue resolution, and ensures better correlation between alerts and infrastructure components. [View links between alerts in network traffic-based alert groups](https://www.servicenow.com/docs/access?context=el-network-traffic-based-link-view&family=yokohama&ft:locale=en-US) : Once a network traffic correlation is enabled, investigate network traffic alert group details and visualize connections through Link View in Express List®. [Group alerts using network traffic-based grouping](https://www.servicenow.com/docs/access?context=network-traffic-correlation-grouping&family=yokohama&ft:locale=en-US) : Group alerts efficiently with network traffic-based alert grouping, which uses discovered TCP connections with ML Service Mapping to correlate alerts on host CIs that have network traffic connections between them. [New role for team level operators](https://www.servicenow.com/docs/access?context=r_InstalledWithEventManagement&family=yokohama&ft:locale=en-US) : Enhance team-level control over alert management with the evt_team_operator role. This role enables operators to manage Event Management operations within their assigned team, including reading and writing alerts, making configuration changes,updating Alert Automation, and setting up new integrations in the Integrations Launchpad. | | Zurich | [Centralized management with the ITOM AIOps configuration center](https://www.servicenow.com/docs/access?context=itom-aiops-conf-center&family=zurich&ft:locale=en-US) : Starting in version 26.11.0, the ITOM AIOps configuration center provides a centralized hub to manage AIOps settings, helping you integrate monitoring tools, optimize alerts, metrics, and logs, and manage services, dashboards, teams, and authorizations for improved visibility and operational efficiency. [Added Recommended category for AIOps 360 Overview dashboards](https://www.servicenow.com/docs/access?context=aiops-360-overview-dashboard&family=zurich&ft:locale=en-US) : Starting in version 26.11.0, added a Recommended category to all officially released dashboards, such as the AIOps 360 Overview dashboard and the AIOps Value Realization dashboard. The category helps you easily identify and access ITOM-approved dashboards. [Add a delay for incident creation from alerts](https://www.servicenow.com/docs/access?context=esc-notify-alert-sow-itom&family=zurich&ft:locale=en-US) : Starting in version 26.11.0, you can add a delay in Respond Automation before incidents are created from alerts. This enables alerts to auto-close if resolved, and it helps to reduce unnecessary incident creation. [Added support for multiple subscriptions of AWS account](https://www.servicenow.com/docs/access?context=aws-events-transform-script&family=zurich&ft:locale=en-US) : Starting in version 2.17.1, added support to enable multiple member accounts to forward CloudWatch/EventBridge events to a centralized account, where a single SNS topic delivers them to the ServiceNow Event Ingestion endpoint. This reduces manual setup from multiple configurations to one and cuts onboarding effort by up to 90%. [Configure Dynatrace metric connector from Integrations Launchpad](https://www.servicenow.com/docs/access?context=configure-dynatrace-metric-pull-connector&family=zurich&ft:locale=en-US) : Starting in version 2.17.1, you can use the Dynatrace metric connector from the Integrations Launchpad to bring metrics from Dynatrace into ServiceNow Metric Intelligence for visualization, enrichment, dynamic thresholds, and anomaly detection. [\[Placeholder link text to key configure-datadog-connector\]](https://www.servicenow.com/docs/access?context=configure-datadog-connector&family=zurich&ft:locale=en-US) : Starting in version 2.17.1, you can use the out-of-the-box Datadog metric connector to integrate Datadog metrics with ServiceNow Metric Intelligence, enabling anomaly detection, metric visualization, enrichment, and correlation of metric anomalies with events and log alerts. [\[Placeholder link text to key configure-kafka-metrics-connector\]](https://www.servicenow.com/docs/access?context=configure-kafka-metrics-connector&family=zurich&ft:locale=en-US) : Starting in version 2.17.1, you can use the new Kafka connector to stream time-series metric data from Kafka topics into ServiceNow Metric Intelligence for real-time monitoring, anomaly detection, and alerting. ITOM [\[Placeholder link text to key c_EM\]](https://www.servicenow.com/docs/access?context=c_EM&family=zurich&ft:locale=en-US) guided setup : Starting in 27.2.1, introduced ITOM Event Management guided setup, providing a sequence of tasks that help you install and get started with Event Management efficiently. [Live updates functionality has been updated in the Service Operation Workspace Lists.](https://www.servicenow.com/docs/access?context=configure-alert-list-autofresh-settings&family=zurich&ft:locale=en-US) : Starting in version 26.11.0, a new toggle switch allows users to enable or disable live updates. When the toggle is set to on, alerts are updated automatically. When the toggle is set to off, a badge displays the number of available updates until the page is refreshed manually. The setting is saved for future logins by the same user. [Explore the new Dependency view for an alert](https://www.servicenow.com/docs/access?context=dependency-maps&family=zurich&ft:locale=en-US) : Starting in version 26.11.0, explore the new Dependency view for an alert. Access maps from the following locations: * in the preview panel, in the Configuration item section for the CI topology * in the Utilities panel of the alert record * in the action drop-down menu * in the Core UI alert form [Respond to multiple alerts in Express List](https://www.servicenow.com/docs/access?context=bulk-alert-response-express-list&family=zurich&ft:locale=en-US) : Starting in version 26.11.0, run response actions on multiple alerts at the same time in Express List. [View links between alerts in new alert groups in Express List®](https://www.servicenow.com/docs/access?context=el-link-view&family=zurich&ft:locale=en-US). : Starting in version 26.9.0, investigate alert group details and visualize connections through Link View in Express List®, now available for log analytics-based alert groups and mixed alert groups. [Anomaly information for log analytic based alerts and metric intelligence alerts in preview panel in Express List®.](https://www.servicenow.com/docs/access?context=view-anomaly-alert-display&family=zurich&ft:locale=en-US) : Starting in version 26.9.0, review visualizations for anomaly information in log analytic-based alerts and metric intelligence alerts in the preview panel in Express List\[var.express-reg-tm\]. [Configure new property for automatic resume of the live list updates following a pause, and configure time ranges in Express List®](https://www.servicenow.com/docs/access?context=express-list&family=zurich&ft:locale=en-US) : Starting in version 26.9.0, admins gain the ability to configure the amount of time until the live list updates resume, after being paused in Express List®. Admins are also able to customize the time range options displayed in Express List®, such as the default time range. [Mixed alert grouping](https://www.servicenow.com/docs/access?context=alert-group-use-cases&family=zurich&ft:locale=en-US) : Combine CMDB-based and tag-based alert grouping strategies into cohesive groups that reduce noise, enabling faster and more effective response. [AIOps 360 overview dashboard](https://www.servicenow.com/docs/access?context=aiops-360-overview-dashboard&family=zurich&ft:locale=en-US) : Gain actionable insights with a 360-degree dashboard that showcases product value, tracks operational efficiency, and highlights automation impact. Monitor alert handling, service health, and AIOps outcomes to drive smarter, faster decisions across IT operations. [Mixed alert grouping in Service Operations Workspace](https://www.servicenow.com/docs/access?context=group-alert-sow-itom&family=zurich&ft:locale=en-US) : Choose how you want to group alerts from the Criteria Type field. Use the Related CIs option to combine CMDB-based and tag-based alert grouping. [Application services for impact calculation](https://www.servicenow.com/docs/access?context=c_EMImpactCalculation&family=zurich&ft:locale=en-US) : Filter the application services to be considered in impact calculation for focused and accurate results. [Metric connector in Integrations Launchpad](https://www.servicenow.com/docs/access?context=configure-metric-pull-connector&family=zurich&ft:locale=en-US) : Configure metric pull connectors to automate data retrieval and seamlessly integrate external metrics for efficient monitoring. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing Event Management features. {#dfrn3-eventmanagement-summary__entry__14} | Release | Release notes | |-|-| | Yokohama | [Property name changes](https://www.servicenow.com/docs/access?context=enable-alert-grouping&family=yokohama&ft:locale=en-US) : Enable CMDB Correlation for Alert Aggregation ( CMDB groups) (sa_analytics.agg.query_cmdb_correlation_enabled) has been renamed Enable CMDB correlation.Enable alert aggregation for CI-based Automated groups (sa_analytics.specific_patterns_enabled) has been renamed Enable ML based Automation correlation.Enable alert aggregation for Text-based groups (sa_analytics.text_based_group_enabled) has been renamed Enable Text based correlation.Use all CMDB relations for CMDB group correlation. This property impacts both CMDB group correlation and Alert Similarity on the Alert form (evt_mgmt.related_cis_get_all_relation_types) has been renamed Use all CMDB relations for CMDB group correlation. [Pull connectors](https://www.servicenow.com/docs/access?context=t_EMConfigureConnectorInstance&family=yokohama&ft:locale=en-US) : Simplifying the setup for Out-of-the-Box (OOTB) event rules that come with the pull connectors that have not yet been activated, deactivated, or modified, the Apply additional matching rules option is now enabled by default. If a rule has been previously applied, you must set this option manually. | | Zurich | [Support for OAuth authentication method in Kafka connector](https://www.servicenow.com/docs/access?context=configure-kafka-consumer-connector&family=zurich&ft:locale=en-US) : Starting in version 2.17.1, you can use OAuth authentication with the Kafka connector, enabling you to securely connect and manage access without storing or sharing static credentials. [Support for SCOM 2025 version](https://www.servicenow.com/docs/access?context=t_EMConfigureSCOMConnector&family=zurich&ft:locale=en-US) : Starting in version 2.17.1, you can now check SCOM 2025 compatibility with the current code, ensuring that the connector setup, alert collection, and Metric Intelligence data ingestion work seamlessly with the latest SCOM release. This helps maintain integration reliability, reduces configuration errors, and ensures smooth upgrade readiness. [Group automation enhancements](https://www.servicenow.com/docs/access?context=group-alert-sow-itom&family=zurich&ft:locale=en-US) : Starting in version 26.11.0, group automation now supports grouping by impacted service instances and related log properties, with enhanced test automation details for better visibility. These updates enable more effective analysis of alert correlations and more accurate validation of grouping logic.The updated Test Automation section provides detailed insights into alert groups, including total alerts, description, grouping category, node, and time, with support for sorting by grouping type. [Validate CI identification in Enrich automation](https://www.servicenow.com/docs/access?context=enrich-alert-sow-itom&family=zurich&ft:locale=en-US) : Starting in version 26.11.0, you can ensure CI attributes are present in the Additional info field of the alert for accurate matching and test CI identification on sample events. Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [Automated regex generation](https://www.servicenow.com/docs/access?context=esc-notify-alert-sow-itom&family=zurich&ft:locale=en-US) : Effortlessly extract event field content into alert fields with automated regex generation, reducing manual effort and improving accuracy. [Group automation](https://www.servicenow.com/docs/access?context=group-alert-sow-itom&family=zurich&ft:locale=en-US) : Added the Criteria Type field, enabling you to choose how alerts are grouped. | [ ] ## Removed Between your current release family and Zurich, some Event Management features or functionality were removed. {#dfrn3-eventmanagement-summary__entry__20} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some Event Management features or functionality were deprecated. {#dfrn3-eventmanagement-summary__entry__26} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | * The "em_alert_lists_auto_refresh" table no longer controls live alert list updates in the Service Operation Workspace Lists. Use the new property, table sys_ux_list, to turn on and off live incoming alert updates. * Event Management connector: Deprecate unused V1 connector definitions during Event Management connector upgrades. * vRealize connector: Enhance the vRealize event connector by replacing the deprecated XML API with a JSON-based API, ensuring compatibility with future versions. | [ ] ## Activation information Review information on how to activate Event Management. {#dfrn3-eventmanagement-summary__entry__32} | Release | Release notes | |-|-| | Yokohama | Activation information : Event Management is available with activation of the Event Management plugin (com.glideapp.itom.snac). For details, see [Request Event Management](https://www.servicenow.com/docs/access?context=t_EMActivatePlugin&family=yokohama&ft:locale=en-US). | | Zurich | Activation information : Event Management is available with activation of the Event Management plugin (com.glideapp.itom.snac). For details, see [Request Event Management](https://www.servicenow.com/docs/access?context=t_EMActivatePlugin&family=zurich&ft:locale=en-US). Important: Event Management is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Event Management we have noted them here. {#dfrn3-eventmanagement-summary__entry__38} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Event Management we have noted them here. {#dfrn3-eventmanagement-summary__entry__44} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Event Management, such as specific requirements or compliance levels. {#dfrn3-eventmanagement-summary__entry__50} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for Event Management we have noted them here. {#dfrn3-eventmanagement-summary__entry__56} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Event Management we have noted them here. {#dfrn3-eventmanagement-summary__entry__62} | Release | Release notes | |-|-| | Yokohama | * Review network traffic-based alert grouping, which uses discovered TCP connections together with ML Service Mapping to correlate alerts on host CIs that have network traffic connections between them. This approach reduces noise, enhances visibility, and accelerates response times by focusing on critical connections and dependencies. * Starting in version 26.3.4, benefit from the new alert grouping based on network traffic correlations: * Investigate network traffic-based alert groups by using Express List®. * Review alert group analysis by Now Assist * View connections between network traffic-based alerts in Link View. * Enable team-level operators to create and manage their own integrations, set up their own alert automations, and enhancing control over alert management for their teams by assigning the new team_operator role. * Review relevant information in the Now Assist panel based on records selected in the Express List®. * Starting in version 2.15.1, you can configure metric connector instances for the [Nagios](https://www.servicenow.com/docs/access?context=configure-nagios-metrics-connector&family=yokohama&ft:locale=en-US), [SolarWinds](https://www.servicenow.com/docs/access?context=configure-solarwinds-connector&family=yokohama&ft:locale=en-US), and [Zabbix](https://www.servicenow.com/docs/access?context=configure-zabbix-metrics-connector&family=yokohama&ft:locale=en-US) monitoring tools to receive metrics directly from these monitoring tools. This enhancement provides the following benefits: * Seamlessly integrate monitoring data from multiple sources into Metric Intelligence. * Improve anomaly detection and alerting with real-time metric ingestion. See [Event Management](https://www.servicenow.com/docs/access?context=c_EM&family=yokohama&ft:locale=en-US) for more information. | | Zurich | * Combine the strengths of CMDB-based and tag-based strategies to create mixed alert groups that reduce noise and reveal clearer, actionable insights. * Effortlessly extract event field content into alert fields with automated regex generation, reducing manual effort and improving accuracy. * Gain actionable insights with AIOps 360-degree overview dashboard to showcase product value. * Accelerate integration setup with seamless installation via the Unified Launchpad store app, guided support for creating integrations, and enhanced observability with the new Service Observability filter. See [Event Management](https://www.servicenow.com/docs/access?context=c_EM&family=zurich&ft:locale=en-US) or [Service Operations Workspace for ITOM](https://www.servicenow.com/docs/access?context=sow-landing-page-itom&family=zurich&ft:locale=en-US) for more information. | [ ]