Thank you for your feedback.
Form temporarily unavailable. Please try again or contact docfeedback@servicenow.com to submit your comments.

Event Management subflows provided

Log in to subscribe to topics and get notified when content changes.

Event Management subflows provided

In the Remediation Subflows area of alert management rules, the subflows provided with the base system are available.

Subflows available

Navigate to Event Management > Rules > Alert Management and click New. Click the Actions tab. In the Remediation Subflows area, double-click the Insert a new row field.

Specify subflow

Click the search icon Search icon to add subflows. The list of subflows that are provided with the base system appears.

List of subflows

Table 1. Subflows provided in the base system
Name Description
Acknowledge Alert Subflow to mark the alert as being Acknowledged. Acknowledge an alert to show that further attention is required.
Attach Knowledge Article (legacy) Subflow to attach a knowledge article to the alert.

This subflow is provided for instances that are migrated from legacy releases (prior to the London release).

Note: Add the Knowledge article column to the Alert Management Rules [em_alert_management_rule] table, and select an article to attach to an alert when the rule executes.
Change Alert to Maintenance Mode Subflow to mark the alert as being in Maintenance.
Close Alert Subflow to mark the alert as being Closed.
Create Incident Subflow to create an incident. Fields from the alert are used to populate the matching fields in the incident that is created.
Note:
  • If there is an existing incident that is attached to the alert, this subflow is not activated.
  • If the alert is in Maintenance, an incident is not created.
Create Major Incident Candidate Subflow to create a major incident candidate. Fields from the alert populate the matching fields in the major incident candidate that is created. A major incident candidate can be upgraded to become a major incident.
Note:
  • If there is an existing incident that is attached to the alert, this subflow is not activated.
  • If the alert is in Maintenance, a major incident candidate is not created.
  • If the Role in group is Secondary, the major incident candidate is not created.
Create Major Incident from Alert Subflow to create a major incident from alert. Fields from the alert are used to populate the matching fields in the major incident that is created.
Note:
  • If there is an existing incident that is attached to the alert, this subflow is not activated.
  • If the alert is in Maintenance, an incident is not created.
  • If the Role in group is Secondary, the major incident candidate is not created.
Create Task (legacy) This subflow uses a task template, if provided, or the EventMgmtCustomIncidentPopulator script for instances migrated from legacy releases (prior to the London release). If configured, apply the task template.
Note: Add the Task template column to the Alert Management Rules [em_alert_management_rule] table, and select a task template and task to apply when the rule executes.
Overwrite Alert Template (legacy) This subflow applies the alert template.

This subflow is provided for instances that are migrated from legacy releases (prior to the London release).

Note: Add the Task type column to the Alert Management Rules [em_alert_management_rule] table, and select an alert template to apply when the rule executes.
  1. Select the subflow that you need.
  2. To customize a subflow, see Create a custom subflow. This topic also describes the input parameters in a subflow.
  3. To specify when the workflow must be executed, double-click the cell under Execution.

    Subflow execution
Feedback