Alert binding to CIs with event rules

When alerts are associated with CIs, the task of remediation is simplified. During alert generation, Event Management uses event rules and other mechanisms to automatically bind alerts to CI information from the CMDB. For tracking purposes and remediation, the alert shows information about the CI that caused the event.

Alert binding process flow

Alerts bind to CIs based on the following process flow:
  1. When an event arrives, Event Management checks the node or CI identifiers.
  2. If no node exists, the generated alert can bind to the CI using the alert Type, Additional information, or Configuration item identifier fields.
  3. If the event has a node value, search for a valid host.
  4. If the event has a host and a CI type, try to bind to a device CI.
  5. If the event has a host, try to bind to the application CI.
Figure 1. How alerts bind to CIs

The event can contain the binding process flow in its Processing Notes field.