Event rule configuration

You can configure event rules to generate alerts for tracking and remediation. Event rules are stored in the Event Rule [em_match_rule] table. The rules do not change the event records in the Event [em_event] table. Instead, changes to event data are stored in the ServiceNow instance memory.

You can use the default event rules or create rules to:
  • Apply an event rule filter to determine whether the rule applies to an event.
  • Apply a transform with Event Match Fields and optional Event Compose Fields to format the alert text.
  • Apply a transform to ignore an event.
  • Apply a threshold to create custom alerts for rapidly recurring events.
  • Automatically create or close alerts.