Key Properties and Their Uses

• Time Frame Settings:
  • evtmgmt.alertinsightalerthistorymin: Defines the time frame (in minutes) to retrieve repeated or similar alert data, defaulting to 30 days.
  • evtmgmt.alertinsightclosedalertwindow: Sets the time window to include alerts that have been closed, defaulting to 3 days after the last update.
• Similarity Criteria:
  • evtmgmt.alertinsightalertsameasfilter: Specifies which alert fields (e.g., source, type, resource, metricname) are used to determine alert similarity.
• Related CIs Configuration:
  • evtmgmt.alertinsightrelatedcistopologylevels: Controls the maximum depth of CI relationships considered within application services, default is 3 levels.
  • Additional properties manage whether to use containment rules, hosting rules, suggested relations, and validation of relation rules—critical for accurate CI association.
• Scoring System:
  • Properties like evtmgmt.alertinsightgroupmapping and level-based mappings assign scores to different relationship types, helping prioritize related CIs based on relevance.
  • Scores accumulate from multiple relationship criteria, enhancing the accuracy of relevance ranking.
• Maximum Related Tasks:
  • evtmgmt.alertinsightmaxtasks limits the number of related tasks retrieved per alert, with a default of 10, optimizing performance and usability.

Metadata and Relationship Rules

The alert insight feature leverages metadata rules to understand parent-child and dependent relationships between CIs. These include:

• Containment Rules: Define the configuration hierarchy (which CIs contain others).
• Hosting Rules: Describe placement and operational relationships (what CIs run on).

Administrators can manage these rules via the CI Class Manager and Metadata Editor modules, enabling precise control over how CIs are related and scored in alert insights.

Practical Benefits for ServiceNow Customers

• Fine-tuning alert retrieval periods helps focus on relevant data without overwhelming the system.
• Customizing similarity criteria and CI relationship depth improves alert correlation accuracy, reducing noise and aiding faster incident resolution.
• Scoring and relationship validation ensure that the most relevant related CIs and tasks are prioritized, enhancing troubleshooting efficiency.
• Using metadata-driven relationships provides a comprehensive view of CI dependencies and impacts for better root cause analysis.