---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Alert management rules for resolving alerts

# Alert management rules for resolving alerts {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Alert management rules for resolving alerts

Alert management rules in ServiceNow Event Management automate responses to alerts by specifying actions like opening incidents, launching remediation, or creating tasks.
These rules help you respond efficiently and consistently to alerts, improving operational workflows and incident resolution.
Show full answer Show less  
Users with the **evtmgmtadmin** role can create and customize alert management rules using filters to target specific alerts and define actions. Users with the **evtmgmtoperator** role can manually run these rules.

## Key Features

* **Rule Configuration:** Define alert filters to specify conditions for rule execution, ensuring actions trigger only on relevant alerts (e.g., severity changes or specific alert attributes).
* **Actions:** Automate responses such as launching subflows, workflows, remediation actions, opening incidents, or launching URLs/applications.
* **Execution Tracking:** Alert execution history is automatically updated with details of invoked actions, providing transparency and auditability.
* **Scheduled Jobs:** Alert management rules are evaluated every 11 seconds by a scheduled job, scalable in large environments by adding more jobs through support.
* **Migration Support:** Existing alert action rules from earlier releases can be migrated to the alert management rule framework, enabling modification and enhancement.
* **Remediation Integration:** Supports orchestration workflows and subflows for automated remediation tasks including system info collection and server rebooting.
* **Synchronization with Alert Grouping:** Configurable to run alert management after alert grouping jobs to avoid duplicate actions on secondary alerts.
* **Cross-platform Remediation:** Allows running commands for alert remediation on remote Linux and Windows Configuration Items (CIs).

## Practical Application for ServiceNow Customers

With alert management rules, ServiceNow customers can automate and customize alert responses to reduce manual intervention and accelerate incident resolution. By using filters and targeted actions, you ensure alerts trigger appropriate workflows based on severity, timing, or other criteria. The built-in tracking and migration capabilities ease management and upgrades of alert response strategies.

For complex environments, leveraging subflows and orchestration workflows enhances remediation efficiency and operational consistency. Additionally, synchronization with alert grouping prevents redundant actions, optimizing resource use and alert handling.

Overall, alert management rules empower you to streamline event management by automating routine alert responses while maintaining flexibility to adapt to evolving operational needs.  
You can configure Event Management to respond to alerts automatically. An alert management rule determines the required alert response, such as to open an incident, knowledge base article, open a task, launch remediation action.{#alert-management-rule__ph_yxn_srr_ddb}

Alert management rules provided with the base system as a store application (Alert Rules Management \[sn_em_arm\]) to help you respond to alerts. You can create filters to specify conditions for the rule so that the remedial action specified in the
rule takes effect only when the conditions are met. For example, launch the required subflow or open an incident based on an alert. The alert's execution history is automatically updated to indicate the actions that were
invoked.

Users with the evt_mgmt_admin role can use the alert management rule designer to create and customize alert management rules to act on specified alerts. Define rules with filters to determine which alerts the rule applies to. You
can create rules to launch applications, URLs, subflows, remediation actions, or take other actions, such as to open an incident. For more information, see [Create an alert management rule](https://servicenow-prod.fluidtopics.net/20AbXsn7zKXBClHW5Ut9Og "Create an alert management rule to track alerts and resolve them by determining the required response, for example, to open an incident or launch remediation action.").

Users with the evt_mgmt_operator role can manually run alert management rules.

## Alert management rule flow {#alert-management-rule__section_b4b_wdm_gfb}

The flow to create and run an alert management rule is:  

<br />

{#alert-management-rule__table_bmf_1ht_zcb__entry__2}

| Component | Description |
|-|-|
| Alert Info | Configure a name and general information for the rule. |
| Alert Filter | Specify a filter to determine to which alerts the rule applies. You can specify the related list conditions. Note: The fields that are not supported for alert filtering are: Overall Event Count, Priority, Priority Group, Priority Breakdown, Tags, and Impacted Services. |
| Actions | Specify the response to the alert, such as to run a subflow, perform remediation action, launch an application, or launch a URL in a browser. |
[Table 1. Alert management rule components]

{#alert-management-rule__table_bmf_1ht_zcb}

## How rules are applied to updated alerts {#alert-management-rule__section_ogf_pgd_b2b}

Alert management rules run on all updated open alerts. Rules don't run on closed alerts, even if they've been updated. The filters determine whether the rule's actions apply to the alert. For example, if a rule's condition indicates that an email message is sent when the alert severity changes to Major, the rule applies to an alert updated by a severity change from Warning to Major.

## Use of filters and other actions {#alert-management-rule__section_fzx_2bt_sdb}

Filters ensure that the rule is invoked only when the configured condition occurs, and not for every update of the alert. For example, you can configure a rule so that updates that aren't relevant (such as a Work notes field update) don't cause the rule to run. As another example, a filter condition can specify that the alert management rule runs only when the alert severity is critical.

You can perform the following actions:

* Specify a filter that determines which alerts the rule applies to.
* In the Related List Conditions section of the form, configure additional conditions, for example, with an Alert \> Parent relationship, to filter for any alerts that were received today.
* Respond to alerts. For example, by using subflows and workflows, create incidents for primary alerts with critical severity, or open a search engine in a browser to search for data according to the description field of the alert.
* Apply remediation. Remediation is based on Orchestration workflows that can be scripted to perform remediation tasks such as gathering system information or rebooting a server.  
  Note:  
  For enhanced performance of Event Management - Evaluate Scoped Alert Rules Management scheduled jobs, use subflows instead of workflows.
{#alert-management-rule__ul_mys_kyl_zt}

## Scheduled jobs that check alert management rules {#alert-management-rule__section_odj_1j1_tdb}

Alert management rules are checked every 11 seconds by the default Event Management - Evaluate Scoped Alert Rules Management0 scheduled job. The job then executes the required actions. For large-scale environments, you can add more than one job. Please contact Customer Service and Support.  
Note:  
Only new users from Vancouver and up get two scheduled jobs: Event Management - Evaluate Scoped Alert Rules Management0 and Event Management - Evaluate Scoped Alert Rules Management1. Users upgrading from previous family releases remain with a single scheduled job Event Management - Evaluate Scoped Alert Rules Management0.

Don't modify the
sn_em_arm.alert_management.num_of_jobs property.

By default, the alert grouping job (Service Analytics group alerts using RCA/Alert Aggregation) and the alert
management (Event Management - Evaluate Scoped Alert Rules Management0) jobs run independently of each other. For more information about coordinating the alert response and the automated alert grouping,
see [Synchronizing alert response with automated alert grouping](https://servicenow-prod.fluidtopics.net/RADurNLimnDj8MXyIpc6VA "Synchronize alert response with grouping by ensuring alert management jobs runs after alert grouping jobs—this prevents duplicate actions like incident creation on secondary alerts.").

## Migrate existing alert action rules {#alert-management-rule__section_r13_2mm_gfb}

Existing alert action rules from an earlier release can be migrated to become alert management rules. You can modify an alert action rule only after migrating it to an alert management rule. For more information, see [Migrate an alert action rule to an alert management rule](https://servicenow-prod.fluidtopics.net/n_UedxwUyjT3z32ZsgU~lg "Existing alert action rules from an earlier release can be executed, but cannot be modified. Alert action rules that have been migrated become alert management rules and all the definitions of the alert action rules are migrated to the alert management rule format. Migrated rules can be modified.").
* **[Create an alert management rule](https://servicenow-prod.fluidtopics.net/20AbXsn7zKXBClHW5Ut9Og)**   
  Create an alert management rule to track alerts and resolve them by determining the required response, for example, to open an incident or launch remediation action.
* **[Event Management subflows in the base system](https://servicenow-prod.fluidtopics.net/hclk8QtJkZ_XBjtdwDExSw)**   
  The subflows provided with the base system appear in the Remediation Subflows area of alert management rules.
* **[Create a custom subflow for alerts](https://servicenow-prod.fluidtopics.net/qpqMjAKpgZhd6g_imRqQnQ)**   
  You can create a subflow according to your requirements. For example, you can resolve alerts, notify teams, or run remediation actions.
* **[Alert executions information](https://servicenow-prod.fluidtopics.net/ksFR8fUf09PuM2sLmWyHjw)**   
  Alert executions information provides a reference to the alert management rule actions that are performed. This information appears in the Alert Management Rule record only if an alert matches the filter in the rule and an action was performed. You can click any link in the Alert Executions list to open the referenced item.
* **[Migrate an alert action rule to an alert management rule](https://servicenow-prod.fluidtopics.net/n_UedxwUyjT3z32ZsgU~lg)**   
  Existing alert action rules from an earlier release can be executed, but cannot be modified. Alert action rules that have been migrated become alert management rules and all the definitions of the alert action rules are migrated to the alert management rule format. Migrated rules can be modified.
* **[Synchronizing alert response with automated alert grouping](https://servicenow-prod.fluidtopics.net/RADurNLimnDj8MXyIpc6VA)**   
  Synchronize alert response with grouping by ensuring alert management jobs runs after alert grouping jobs---this prevents duplicate actions like incident creation on secondary alerts.
* **[Configure alert remediation actions](https://servicenow-prod.fluidtopics.net/6DlBjkRmM2XnQ8jHuWFv0g)**   
  Run commands to perform alert remediation on remote Linux and Windows CIs.