Create a security incident from an Event Management alert

When Event Management is activated, you can manually create security incidents from the Alert form.

Before you begin

The Event Management plugin (com.glideapp.itom.snac) requires a separate subscription and a ServiceNow personnel must activate the plugin. This plugin includes demo data and activates related plugins if they are not already active. The Service Analytics plugin ( is activated automatically when Event Management is activated.

Role required: evt_mgmt_admin, evt_mgmt_operator, or evt_mgmt_user


  1. Navigate to Event Management > All Alerts.
  2. Click the alert Number.
  3. Click Create Security incident.
  4. Click Update.