ITOM deep-dive · LessonBy Praveen T, ServiceNow Trainer, 9 yrs · Published · ServiceNow · all levels
Event rules and alerts
Turn monitoring noise into actionable alerts with event rules, binding, thresholds and alert management.
Quick answer
Turn monitoring noise into actionable alerts with event rules, binding, thresholds and alert management.
Key takeaways
- Events are raw, alerts are the working record
- CI binding is what makes impact and automation possible
- Thresholds and correlation are how you cut noise
- Not every alert deserves an incident
From event to alert
Connectors pull events from monitoring tools. Event rules parse them, bind them to a CI, set severity and decide whether they create an alert. Alerts are the working unit, events are raw material.
Binding to a CI
An alert without a CI cannot drive impact or automation. Binding uses the fields in the event payload against CMDB identifiers. When binding fails consistently, the fix is usually in the CMDB, not in the rule.
Reducing noise
Alert management earns its keep by not waking people up.
- Use threshold rules so five flaps in a minute become one alert
- Group related alerts with alert correlation rules
- Set an auto close so alerts clear when the source clears
- Route only what is actionable to incident creation, everything else stays as an alert
Practice challenge
+0 XPStreak ×0
Question 1 of 2
What connects an alert to impacted services?
Frequently asked questions
Should every alert create an incident?
No. Create incidents for actionable, service affecting alerts. Everything else stays in alert management for analysis.
Why do alerts have no CI?
The identifier in the payload does not match anything in the CMDB. Fix the CMDB data or adjust the binding fields.