Event Management tag based alert clustering definition form

  • Release version: Washingtondc
  • Updated February 1, 2024
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Event Management Tag Based Alert Clustering Definition

    The Tag Based Alert Clustering Definition form in ServiceNow's Event Management module allows users to create or modify alert clustering definitions. This functionality is essential for efficiently managing incoming alerts, ensuring they are grouped effectively based on specified criteria.

    Show full answer Show less

    Key Features

    • Name: Unique identifier for each alert clustering definition.
    • Active: Option to activate the definition, selected by default.
    • Order: Determines the sequence in which definitions are tested against incoming alerts; lower values are tested first (default = 1000).
    • Domain: Read-only field indicating the domain of the current record.
    • Assignment Group: Specifies the group responsible for handling the alert; if none is defined, the rule is treated as global.
    • Description: Optional field for adding context to the alert clustering definition.
    • Filter: Criteria that incoming alerts must meet to be clustered; case-sensitive by default, with options to adjust sensitivity and exclude specific alert fields.
    • Override Group Description: Customizes the default description for alert groups created by this definition.
    • Clustering Timeframe: Sets the maximum time (in minutes) allowed between alerts for them to be grouped together (default = 60, range = 0-1440).
    • Tags: Assigns specific tags to the alert clustering definition, determining which alerts are included in the group.

    Key Outcomes

    By utilizing the Tag Based Alert Clustering Definition form, ServiceNow customers can efficiently manage alerts by grouping them based on defined criteria. This leads to improved incident management, allowing teams to respond more effectively to related alerts and minimizing alert fatigue. Proper configuration ensures only relevant alerts are clustered, enhancing visibility and response times for IT operations.

    The form for creating or modifying a tag based alert clustering definition displays detailed information about the definition.

    Table 1. Tag based alert clustering definition form
    Field Description
    Name Name of the alert clustering definition.

    Definition names must be unique.
    Active Select to activate the definition. This option is selected by default.
    Order The order by which definitions are tested for incoming alerts. Those with lower Order values are tested first.

    When an alert matches one of the definitions' filters, it continues searching for more definitions.

    Default value = 1000
    Domain The domain in which the current record was created. Read-only.
    Assignment group Assignment group that works on the alert.

    If no assignment group is defined in the alert rule, then this alert rule is considered as a global rule.

    When the rules are running – first the global rules run and then the rules that belong to the assignment group of the alert.
    Description Enter an optional description of the alert clustering definition.
    Filter Set conditions that incoming alerts must meet to be measured by the alert clustering definition's tags. If the tags correspond to alerts that exist in the system and are within the Clustering timeframe (minutes) value, the incoming alerts join with the existing alerts to form an alert group.
    After configuring the filter, you can click the Preview button to view how many existing alerts match the filter's condition.
    Note:
    • Matching alerts are not automatically included together in an alert group. Alerts are grouped only if they have corresponding alert clustering tags.
    • Filter parameters are case sensitive by default. To disable case sensitivity, set the sa_analytics.correlation_case_sensitive parameter to false.
    • You can also configure alert fields to be excluded from the search, using the sn_em_tbac.tag_excluded_alert_fields property. By default, the following are excluded by this property:
      • type
      • event_class
    Override group description Default group descriptions begin with a “Group of alerts” prefix, followed by the description of the primary alert in the group. You may override this group description by selecting the Override group description check box. Then, in the Custom description field, type a description. This description is used as the description of the groups that are created by this alert clustering definition.
    Note:
    You cannot save the form if you left the Custom description field blank or with the default 'Group of alerts' text.
    Clustering timeframe (minutes) The maximum time, in minutes, allowed between alerts for the alerts to be grouped together. For example, a value of 60 indicates that an alert generated within 60 minutes of the most recent alert is included in the alert group. Any alert generated after this time is not included in the alert group.

    Default value = 60

    Permitted values = 0-1440
    Tag Based Alert Clustering Definitions Tags M2M Select the alert clustering tags to be assigned to the alert clustering definition. Alerts that meet the criteria specified in the selected tags are included in the alert group.

    The available options are the tags created on the Tag Based Alert Clustering Tags page.