Combined Event Management release notes for upgrades from Vancouver to Zurich

How to use this page

To help you prepare for your upgrade, we have combined the cross-family Event Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Vancouver to Zurich.

Tip:

If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

Important information for upgrading Event Management to Zurich

Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed.


Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

New features

Between your current release family and Zurich, new features were introduced for Event Management.


Release	Release notes
Vancouver	Container alert for tag-based groups Enhance alert group creation using tag-based alert clustering. The primary alert of a tag-based group is a container of child alerts that meet the Tag-Based Clustering definition. Event Management Connectors domain personalization Enhance domain separation to be able to create events in different domains with configurable domain separation logic for events. Agent assist Enhance the user experience by adding the Agent Assist panel to alerts in the Service Operations workspace. Create event field mappings Provide more comprehensive information in an alert by mapping values from the reference table to the alert fields or tags.
Washington DC	Team-based integrations in Event Management Ensure connector ownership and execution of rules on a team level, maintaining consistency and hierarchy while offering flexibility and customization options for teams. Automate the assignment of alerts based on integration ownership and configuration item (CI) ownership so alerts are routed to the appropriate team members responsible for the integrated systems. Event forwarding Forward events from one ServiceNow instance to other instances in non-production environments without having to change the production environment, thus accelerating the event processing testing life cycle. Free-text search for alerts in Express List Starting in version 23.2.1, find alerts in the Express List by using free-text search. Keyboard shortcuts in Express List Starting in version 23.2.1, speed up your work in Express List with keyboard shortcuts. Timeline View of alerts in an alert group in Express List Starting in version 23.2.1, use Timeline View in Express List for a chronological visualization of the alerts in an alert group. This feature offers a comprehensive view of when the alerts occurred, when changes in their severity took place, and other data for efficient triage and Mean Time to Resolution (MTTR). Link View in Express List Starting in version 23.2.1, view the connections between alerts in rules-based or CMDB-based alert groups in Link View. Link View offers a visual representation of the relationships between the alerts in the group. Alert analysis of alert groups in Express List created by Now Assist using generative AI Starting in version 23.2.1, view an alert analysis of alert groups in Express List. The alert group analysis provides a simplified, human-readable description of the alerts in an alert group to help you investigate the alerts.
Xanadu	Customize the default order of the alert correlation algorithm Configure the alert correlation algorithm sequence by customizing it according to your needs. Create team-based alert management rules Assign alert management rules to specific assignment groups so that only those alerts that are assigned to the specified group are executed. Create tag based alert clustering definitions by teams Create tag clusters only for alerts that are assigned to an alert group by assigning tag-based alert clusters to specific groups. Restrict alert groups across alert assignment groups Improve the accuracy and relevance of the alert correlation by grouping alerts according to a diverse set of requirements. Scale out for alert group creation Ensure efficiency when running a job during high-alert traffic by scaling out the alert grouping job. View unified service map and the impact paths in Service Operations Workspace Explore the updated service map in the Service Operations Workspace, designed to focus on the path that was affected by an alert to help you quickly assess its impact on a service. The map displays all configuration items (CIs) for services with up to 60 CIs, regardless of alert status. For services with over 60 CIs that have alerts, it shows the path of the most severe, most recent alert. You can also investigate an even broader view of the service topology. Access the service map directly from Service Operations Workspace, or through the preview panel or an impacted service in Express List. Perform bulk actions on alerts in Express List Perform an action on up to 1,000 alerts in the Active alerts list simultaneously. Remove alerts from an alerts group in Express List Remove secondary alerts from an alert group directly from the Express List pane or from the preview panel. Hide closed alerts on the preview panel and in Link View in Express List View only the open alerts on the preview panel and in Link View in Express List by toggling to hide the closed alerts. View data on impacted services on the preview panel in Express List View information about Impacted Services on the preview panel and in Link View in Express List and open the Service Map and Metric Explorer directly from the panel. Create an incident with Now Assist in Express List Generate incidents from alerts in Express List with a summary created by genAI that includes details on configuration items and impacted services. View data on configuration items on the preview panel in Express List View additional details about configuration items (CIs) that are bound to alerts on the Express List preview panel. Speed up alert resolution with a Now Assist analysis of past related incidents Enhance efficiency and reduce downtime with a Now Assist analysis of past incidents on the same or related CIs. Now Assist investigates historical data to identify past incidents related to the current alert and reports their frequency and criticality levels. It also provides a summary of effective strategies used to resolve them. In addition, Now Assist offers contact information for individuals or teams who have resolved similar incidents in the past and could assist when needed. Generate an alert group description in Express List using Now Assist Use Now Assist to generate a description of an alert group in Express List that encompasses all the alerts within the group. The generated description replaces the original description of the group. Launch an alert analysis from the Now Assist panel Analyze an alert from the Now Assist panel. The alert analysis displays directly in the Now Assist panel for convenient review.
Yokohama	Group alerts using network traffic-based grouping Group alerts efficiently with network traffic-based alert grouping, which uses discovered TCP connections with ML Service Mapping to correlate alerts on host CIs that have network traffic connections between them. View links between alerts in network traffic-based alert groups Once a network traffic correlation is enabled, investigate network traffic alert group details and visualize connections through Link View in Express List®. New role for team level operators Enhance team-level control over alert management with the evt_team_operator role. This role enables operators to manage Event Management operations within their assigned team, including reading and writing alerts, making configuration changes,updating Alert Automation, and setting up new integrations in the Integrations Launchpad. [Placeholder link text to key esc-notify-alert-sow-itom] Starting in version 26.7.0, execute response subflows automatically, manually, or both for alerts that match specific conditions through the Run Other Response Actions option of Respond Automatic. This enhancement offers better control over automated responses with configurable execution limits and multiple response actions. [Placeholder link text to key enrich-alert-sow-itom] Starting in version 26.7.0, link a CI to an alert for more accurate IT component mapping though the Improve Configuration Item (CI identification option of Enrich Automation. This enhancement improves alert visibility, speeds up issue resolution, and ensures better correlation between alerts and infrastructure components.
Zurich	Mixed alert grouping Combine CMDB-based and tag-based alert grouping strategies into cohesive groups that reduce noise, enabling faster and more effective response. AIOps 360 overview dashboard Gain actionable insights with a 360-degree dashboard that showcases product value, tracks operational efficiency, and highlights automation impact. Monitor alert handling, service health, and AIOps outcomes to drive smarter, faster decisions across IT operations. Mixed alert grouping in Service Operations Workspace Choose how you want to group alerts from the Criteria Type field. Use the Related CIs option to combine CMDB-based and tag-based alert grouping. Application services for impact calculation Filter the application services to be considered in impact calculation for focused and accurate results. Metric connector in Integrations Launchpad Configure metric pull connectors to automate data retrieval and seamlessly integrate external metrics for efficient monitoring. View links between alerts in new alert groups in Express List®. Starting in version 26.9.0, investigate alert group details and visualize connections through Link View in Express List®, now available for log analytics-based alert groups and mixed alert groups. Anomaly information for log analytic based alerts and metric intelligence alerts in preview panel in Express List®. Starting in version 26.9.0, review visualizations for anomaly information in log analytic-based alerts and metric intelligence alerts in the preview panel in Express List[var.express-reg-tm]. Configure new property for automatic resume of the live list updates following a pause, and conﬁgure time ranges in Express List® Starting in version 26.9.0, admins gain the ability to conﬁgure the amount of time until the live list updates resume, after being paused in Express List®. Admins are also able to customize the time range options displayed in Express List®, such as the default time range. Centralized management with the ITOM AIOps configuration center Starting in version 26.11.0, the ITOM AIOps configuration center provides a centralized hub to manage AIOps settings, helping you integrate monitoring tools, optimize alerts, metrics, and logs, and manage services, dashboards, teams, and authorizations for improved visibility and operational efficiency. Added Recommended category for AIOps 360 Overview dashboards Starting in version 26.11.0, added a Recommended category to all officially released dashboards such as AIOps 360 Overview dashboard, AIOps Value Realization dashboard, to help you easily identify and access ITOM-approved dashboards. Add a delay for incident creation from alerts Starting in version 26.11.0, you can add a delay in Respond Automation before incidents are created from alerts, allowing alerts to auto-close if resolved and helping reduce unnecessary incident creation. Added support for multiple subscriptions of AWS account Starting in version 2.17.1, added support to enable multiple member accounts to forward CloudWatch/EventBridge events to a centralized account, where a single SNS topic delivers them to the ServiceNow Event Ingestion endpoint, reducing manual setup from multiple configurations to one and cutting onboarding effort by up to 90%. Configure Dynatrace metric connector from Integrations Launchpad Starting in version 2.17.1, you can use the Dynatrace metric connector from the Integrations Launchpad to bring metrics from Dynatrace into ServiceNow Metric Intelligence for visualization, enrichment, dynamic thresholds, and anomaly detection. [Placeholder link text to key configure-datadog-connector] Starting in version 2.17.1, you can use the out-of-the-box Datadog metric connector to integrate Datadog metrics with ServiceNow Metric Intelligence, enabling anomaly detection, metric visualization, enrichment, and correlation of metric anomalies with events and log alerts. [Placeholder link text to key configure-kafka-metrics-connector] Starting in version 2.17.1, you can use the new Kafka connector to stream time-series metric data from Kafka topics into ServiceNow Metric Intelligence for real-time monitoring, anomaly detection, and alerting. ITOM [Placeholder link text to key c_EM] guided setup Starting in 27.2.1, introduced ITOM Event Management guided setup, providing a sequence of tasks that help you install and get started with Event Management efficiently. Live updates functionality has been updated in the Service Operation Workspace Lists. Starting in version 26.11.0, a new toggle switch allows users to enable or disable live updates. When the toggle is set to on, alerts are updated automatically. When the toggle is set to off, a badge displays the number of available updates until the page is refreshed manually. The setting is saved for future logins by the same user. Explore the new Dependency view for an alert Starting in version 26.11.0, explore the new Dependency view for an alert. Access maps from the following locations: in the preview panel, in the Configuration item section for the CI topology in the Utilities panel of the alert record in the action drop-down menu in the Core UI alert form Respond to multiple alerts in Express List Starting in version 26.11.0, run response actions on multiple alerts at the same time in Express List.

Changes

Between your current release family and Zurich, some changes were made to existing Event Management features.


Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.
Xanadu	Alert page performance enhancements Benefit from the enhanced load time of the alert forms and service dashboard. Calculate impact during loop dependency Support for circular (loop) dependency between configuration items in the impact tree is enabled. Automated alert groups perform tag-based alert clustering Tag-based alert group correlation is performed as part of automated alert groups.
Yokohama	Property name changes Enable CMDB Correlation for Alert Aggregation ( CMDB groups) (sa_analytics.agg.query_cmdb_correlation_enabled) has been renamed Enable CMDB correlation. Enable alert aggregation for CI-based Automated groups (sa_analytics.specific_patterns_enabled) has been renamed Enable ML based Automation correlation. Enable alert aggregation for Text-based groups (sa_analytics.text_based_group_enabled) has been renamed Enable Text based correlation. Use all CMDB relations for CMDB group correlation. This property impacts both CMDB group correlation and Alert Similarity on the Alert form (evt_mgmt.related_cis_get_all_relation_types) has been renamed Use all CMDB relations for CMDB group correlation. Pull connectors Simplifying the setup for Out-of-the-Box (OOTB) event rules that come with the pull connectors that have not yet been activated, deactivated, or modified, the Apply additional matching rules option is now enabled by default. If a rule has been previously applied, you must set this option manually.
Zurich	Automated regex generation Effortlessly extract event field content into alert fields with automated regex generation, reducing manual effort and improving accuracy. Support for OAuth authentication method in Kafka connector Starting in version 2.17.1, you can use OAuth authentication with the Kafka connector, allowing you to securely connect and manage access without storing or sharing static credentials. Support for SCOM 2025 version Starting in version 2.17.1, you can now check SCOM 2025 compatibility with the current code, ensuring that the connector setup, alert collection, and Metric Intelligence data ingestion work seamlessly with the latest SCOM release. This helps maintain integration reliability, reduces configuration errors, and ensures smooth upgrade readiness. Group automation enhancements Starting in version 26.11.0, group automation now supports grouping by impacted service instances and related log properties, with enhanced test automation details for better visibility. These updates enable more effective analysis of alert correlations and more accurate validation of grouping logic. The updated Test Automation section provides detailed insights into alert groups, including total alerts, description, grouping category, node, and time, with support for sorting by grouping type. Validate CI identification in Enrich automation Starting in version 26.11.0, you can ensure CI attributes are present in the Additional info field of the alert for accurate matching and test CI identification on sample events.

Removed

Between your current release family and Zurich, some Event Management features or functionality were removed.


Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.
Xanadu	The Event Management Mobile application is no longer available.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Deprecations

Between your current release family and Zurich, some Event Management features or functionality were deprecated.


Release	Release notes
Vancouver	The Operator Workspace is deprecated. Use Service Operations Workspace instead.
Washington DC	No updates for this release.
Xanadu	The following dashboards have been deprecated: Event Management scorecards Event Management insights Event Management overview Health Log Analytics Overview The Service Management dashboard is being prepared for future deprecation. It will be hidden and no longer activated on new instances but will continue to be supported. For details, see the Deprecation Process article (KB0867184) in the Now Support knowledge base.
Yokohama	No updates for this release.
Zurich	Event Management connector: Deprecate unused V1 connector definitions during Event Management connector upgrades. vRealize connector: Enhance the vRealize event connector by replacing the deprecated XML API with a JSON-based API, ensuring compatibility with future versions. The "em_alert_lists_auto_refresh" table no longer controls live alert list updates in the Service Operation Workspace Lists. Use the new property, table sys_ux_list, to turn on and off live incoming alert updates.

Activation information

Review information on how to activate Event Management.


Release	Release notes
Vancouver	Event Management is available with activation of the Event Management plugin (com.glideapp.itom.snac). For details, see Request Event Management.
Washington DC	Event Management is available with activation of the Event Management plugin (com.glideapp.itom.snac). For details, see Request Event Management.
Xanadu	Event Management is available with activation of the Event Management plugin (com.glideapp.itom.snac). For details, see Request Event Management.
Yokohama	Event Management is available with activation of the Event Management plugin (com.glideapp.itom.snac). For details, see Request Event Management.
Zurich	Event Management is available with activation of the Event Management plugin (com.glideapp.itom.snac). For details, see Request Event Management.

Additional requirements

If any additional requirements were introduced or changed for Event Management we have noted them here.


Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Browser requirements

If any specific browser requirements were introduced or changed for Event Management we have noted them here.


Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Accessibility information

Review details on accessibility information for Event Management, such as specific requirements or compliance levels.


Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Localization information

If there are specific localization considerations for Event Management we have noted them here.


Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Highlight information

If there are specific highlight considerations for Event Management we have noted them here.


Release	Release notes
Vancouver	Improve the user experience and correlation logic for tag-based alert clustering. Display relevant Knowledge articles to operators using Agent assist. Increase agility and time to value with configurable domain separation for alerts. Enrich alerts information using alert tags mapping from non-CMDB tables. See Event Managementfor more information.
Washington DC	Ensure connector ownership and execution of rules on a team level, maintaining consistency and hierarchy while offering flexibility and customization options for teams. Shorten your testing cycle by creating a stream of events from your production environment to your non-production environment enabling direct testing and evaluation of event rules, event field mappings, alert management rules, alert correlation, and so on, without having to change your production environment. Use a free-text search to find alerts in the Express List. Speed up your work in Express List by using keyboard shortcuts. View the sequence of events of an alert group at a glance in the Timeline View. View the connections between alerts in rules-based or CMDB-based alert groups in Link View. View an alert group analysis created by Now Assist using generative AI. See Event Management for more information.
Xanadu	Visualize the chain of events that caused an issue by viewing an alert group timeline in Express List. Understand the connection between the alerts by using Alert Assist's AI-driven technical analysis on alert groups. Use the enhanced service map for alert impact visualization in Service Operations Workspace and Express List. Select all alerts in Express List to perform bulk actions. Remove alerts from an alerts group in Express List. Hide closed alerts in Express List. View data on Impacted Services in the preview panel in Express List. Create an incident with an AI-generated summary from alerts in Express List. View data on configuration items (CIs) on the preview panel in Express List. Optimize alert resolution with AI-driven investigation of past related incidents by Now Assist. Generate an alert group description in Express List using Now Assist. Launch an alert analysis from the Now Assist panel. See Event Management for more information.
Yokohama	Review network traffic-based alert grouping, which uses discovered TCP connections together with ML Service Mapping to correlate alerts on host CIs that have network traffic connections between them. This approach reduces noise, enhances visibility, and accelerates response times by focusing on critical connections and dependencies. Starting in version 26.3.4, benefit from the new alert grouping based on network traffic correlations: Investigate network traffic-based alert groups by using Express List®. Review alert group analysis by Now Assist View connections between network traffic-based alerts in Link View. Enable team-level operators to create and manage their own integrations, set up their own alert automations, and enhancing control over alert management for their teams by assigning the new team_operator role. Review relevant information in the Now Assist panel based on records selected in the Express List®. Starting in version 2.15.1, you can configure metric connector instances for the Nagios, SolarWinds, and Zabbix monitoring tools to receive metrics directly from these monitoring tools. This enhancement provides the following benefits: Seamlessly integrate monitoring data from multiple sources into Metric Intelligence. Improve anomaly detection and alerting with real-time metric ingestion. See Event Management for more information.
Zurich	Combine the strengths of CMDB-based and tag-based strategies to create mixed alert groups that reduce noise and reveal clearer, actionable insights. Effortlessly extract event field content into alert fields with automated regex generation, reducing manual effort and improving accuracy. Gain actionable insights with AIOps 360-degree overview dashboard to showcase product value. Accelerate integration setup with seamless installation via the Unified Launchpad store app, guided support for creating integrations, and enhanced observability with the new Service Observability filter. See Event Management or Service Operations Workspace for ITOM for more information.