Operator phase 2: Triage an alert

After you analyze and acknowledge an alert, you must triage it. The triage phase involves verifying alert correlation and taking an action to help resolve the issue that caused the alert. This topic covers the most common triage task: creating an incident from an alert.

Before you begin

Note: The Operator Workspace interface is available only to customers who have upgraded from a release prior to the Utah release. New customers as of the Utah release can use the Service Operations Workspace for ITOM, which offers an enhanced UI for managing alerts.

Role required: evt_mgmt_operator

Procedure

1. Before you start to work on the alert, check whether other alerts should be correlated with the one you just reviewed:

   1. Navigate to Event Management > Service Operations Workspace.

   2. Click the same application service tile and review the alerts in the Alerts list.

   3. If multiple alerts are present, open one to determine if it is related to the other alert, or if the underlying issue is the same in both alerts.

      For example, if an alert is associated with a web server and there is already an alert for the database issue, correlate the web server alert as a secondary alert with the database alert as the primary alert.

   4. Open the secondary alert, click the lookup icon (

    This creates a primary \(parent\) / secondary \(child\) relationship between the two alerts.

5.  Repeat this process to correlate as many secondary alerts as necessary.

6.  Navigate back to the Service Operations Workspace dashboard and verify that the primary alert displays an icon in the **Group** column.

    **Note:** Your administrator can set up rules that let the system automatically correlate alerts so that you do not need to do so manually. In that case, a **Feedback** field appears on the Alert form. Select **Yes** if the system correlated the alert correlated correctly, or **No** if not. Currently, the feedback option is available but does not trigger further actions after being logged.

1. Open the primary alert.

2. On the Alert form, click Actions > Create Incident.

   If your organization uses Security Incident Response, the button is Create Security incident.

   The Flow Designer opens.

1. Click Refresh.

   The Execution Details page opens.

1. Click Open Context Record and then fill in the Incident form.

1. Click Submit to create the incident.

   The Alert you are working on reappears. On the Alert form, the incident is populated in the Task field. You can also see the incident number in the Task column on the Service Operations Workspace dashboard.

What to do next

There are other tasks you perform as part of the triage stage:

• Run a remediation workflow on an alert if your Event Management administrator already set up a workflow in your ServiceNow instance and your policies allow you to trigger it from the alert.
• Launch a web application from an alert to open a website or an event monitoring tool that provides more information about the alert.
• Associate a knowledge base article with an alert if there is existing information about the alert that might help resolve the underlying issue.
• Put an alert into maintenance to temporarily hide it from the Service Operations Workspace dashboard if the alert does not require action at this time.

If you do not need to perform any other triage actions, proceed to Phase 3: Close an alert.

• Run a remediation workflow on an alert
  As an Event Management operator, you can also run a workflow on your ServiceNow instance that helps remediate the alert. For example, you might run a workflow that automatically restarts a server on your network, which might resolve an alert about CPU usage.
• Launch a web application from an alert
  As an Event Management operator, you can also launch a web application from an alert. The web application might be a console for the event monitoring tool that your organization uses, or any external website that provides additional information you might need about the alert.
• Associate a knowledge base article with an alert
  As an Event Management operator, you can associate a knowledge base (KB) article with the alert to capture additional information about the alert. This might include a procedure that someone has to follow to resolve the underlying issue on your network, or a best practice to prevent the issue from reoccurring.
• Put an alert into maintenance
  As an Event Management operator, you can put an alert into maintenance if the alert does not require any further action, but you still want to keep the alert active. Putting the alert into maintenance hides it from the Service Operations Workspace dashboard so that other operators do not need to access it, but it does not close the alert.

Parent Topic:What Event Management operators do