Product documentation Docs
    • English
    • Deutsch
    • 日本語
    • 한국어
    • Français
  • More Sites
    • Now Community
    • Developer Site
    • Knowledge Base
    • Product Information
    • ServiceNow.com
    • Training
    • Customer Success Center
    • ServiceNow Support Videos
  • Log in

Product documentation

  • Home
How search works:
  • Punctuation and capital letters are ignored
  • Special characters like underscores (_) are removed
  • Known synonyms are applied
  • The most relevant topics (based on weighting and matching to search terms) are listed first in search results
Topics are ranked in search results by how closely they match your search terms
  • A match on the entire phrase you typed
  • A match on part of the phrase you typed
  • A match on ALL of the terms in the phrase you typed
  • A match on ANY of the terms in the phrase you typed

Note: Matches in titles are always highly ranked.

  • Release version
    Table of Contents
    • IT Operations Management
Table of Contents
Choose your release version
    Home Orlando IT Operations Management IT Operations Management ITOM Health Event Management Manage and monitor alerts Alert intelligence Manage alert lists in Operator Workspace

    Manage alert lists in Operator Workspace

    • Save as PDF Selected topic Topic & subtopics All topics in contents
    • Unsubscribe Log in to subscribe to topics and get notified when content changes.
    • Share this page

    Manage alert lists in Operator Workspace

    Lists that are specific to Event Management alerts in Operator Workspace are provided in the base system and are located in the Lists panel.

    Alert lists in Workspace

    Filtered lists
    Event Management provides lists that are filtered into various categories. Click the required filtered list in Operator Workspace to display the alerts that you need.
    1. In the Workspace navigation bar, click List icon.

      The Lists panel displays the default Event Management categorized lists.


      Alert lists in workspace

    2. In the Lists panel, under Alerts, the default filters are:
      Table 1. Provided alert filters
      Filter Description
      Top Priority Open alerts that are in the highest Priority group category.
      Top Severity Open alerts that have the highest Severity.
      Open Alerts Open alerts.
      Acknowledged Alerts Alerts whose Acknowledged field has been selected.
      All Alerts Open and closed alerts.
      Assigned to me Alerts assigned to the logged in user.
      Note: Perform all actions on alerts from the All Alerts tab, which does not refresh automatically. If you perform actions on another tab while the list refreshes, your action is cancelled.
    Create a filtered list
    You can create a list filtered according to your requirements, and you can save the list using an easy-to-identify name.
    1. In the Workspace navigation bar, click My Lists.
    2. At the bottom of the Lists panel, click New list.
    3. On the form, fill in the fields.
      Table 2. New List form
      Filter Description
      List name Name for the custom list.
      Table Database table from which the alert list fields are to be populated.
      Conditions Conditions that you define to select the required fields for the alert list.
      Columns Columns to be displayed in the alert list, chosen from the selected database table.
    4. Click Save.

      In the Workspace navigation bar, the new custom filtered list appears in the My Lists pane.

    Alert list functions
    You can select one or more alerts on the alert list and click the relevant button on the top of the form:
    Table 3.
    Button name Description
    Acknowledge Acknowledge the alerts to indicate that they require attention.
    Maintenance Place the alerts in maintenance to indicate that the alert's CI is in the Maintenance state.
    Close Close the alerts.
    Assign to me Assign the alerts to the logged in user.
    Configure alert list refresh
    By default, alerts in the alert lists are automatically updated (auto-refresh) whenever an action is performed on an alert. You can configure the amount of time, in seconds, after which the alert list refreshes when an action is performed.

    You can also disable auto-refresh and configure how often the alert list is updated. This is useful when many alerts are being processed continuously, so that the list is not constantly refreshing.

    1. In the navigation pane, enter sys_properties_list.do in the search field.
    2. To change the alert list refresh time, modify these properties:
      Table 4. Properties to configure alert list refresh
      Property Description
      evt_mgmt.ai_refresh_time_to_wait_after_manual_action Alert list refresh time (in seconds) after a manual action has been performed on the alert.
      evt_mgmt.ai_refresh_time_interval Amount of time (in seconds) after which alert list refreshes, regardless of whether any action was performed on the alerts.

    You can create a new list on the Alert Lists Auto Refresh page by entering em_alert_lists_auto_refresh.list in the navigation pane. Clear the Enable Refresh option so that the list does not refresh automatically.

    Actions you can perform in lists
    From the list of alerts in Workspace, you can perform the following actions.
    Search the list
    Search just within the list you have open. The list search automatically searches all the columns in the list.
    Note: If any records are hidden or removed due to security access restrictions, you see a message with the number of records that were hidden.
    Sort columns
    Click the column headings to determine the sort order of a column. The arrow next to the column name indicates the current sort order. A downward pointing arrow indicates that the column is sorted in descending order. Only the primary sort order is indicated. The system remembers the most recent sort order that you choose for a specific column.

    Column sorting follows the same default behavior as the platform. If a column is not currently sorted, it sorts ascending unless the column data type is a Date. Dates are sorted as descending by default.

    Change the number of rows per page
    In the list footer, click the <Number> rows per page button and select the number of rows you want to display.
    Open a record
    Click anywhere in the row to open a record. The list closes and the record opens in a new tab.
    Tab levels in an alert form
    There are two levels of tabs in the alert form in the Workspace page.
    Highest tab level
    The alert number of the open alert displays in the highest tab level. The alert number of each subsequent alert that you open displays in its own tab. You can open up to 10 tabs.

    Alert tab in workspace

    Secondary tab level
    In the alert form, click an object to open it in a secondary level tab. In the second level, you can have tabs that show, for example, details of the alert, related task (Incident) of the alert, or related CI of the alert.

    Secondary alert tab in workspace

    Alert state
    If an alert is in Closed state and is changed to Open, after saving the alert and refreshing the alert record, the Actions button shows in the alert ribbon.

    A user with the role of evt_mgmt_admin can change the state of an alert.

    To change the state of an alert from Closed to Open:

    1. Select the required alert in the alert list.
    2. In the Details tab, in the State area, select Open and click Save.

      The Actions button shows in the alert ribbon.

      Alert ribbon Action button

    View a topology service map
    You can view a topology map of all services affected by an alert. Click the Actions button for the alert and select Dependency View. For details on the topology map, see View monitored services.
    Create a major incident from an alert
    When an alert meets the criteria set in the Alert Filter tab (on the legacy UI), you can create a major incident for the alert. Click the Actions button for the alert and select Major Incident. For details on managing major incidents, see Major incident management.
    When using the integration between the Customer Service Management and Event Management applications, you can activate an alert rule to automatically create a proactive case from an alert when an incident is created. For more details, see Activate an alert rule to automatically create a proactive case from an alert.
    Create a case from an alert
    Customer Service Management provides an integration with ITOM Event Management. This integration enables you to improve the customer experience by breaking down the silos that exist between the processes and systems used by front line customer service and back-office operations teams. By monitoring issues and creating cases proactively, you can better correlate customer issues and provide faster responses.
    If you are using the integration between the Customer Service Management and Event Management applications, you can create a case for customer install base affected by an alert. For more details, see Manually create a proactive case from an alert.
    View alert record details
    To view the details of an alert record, click an alert in an alert list.

    The following graphic depicts the details of an alert that is in Open state.

    Alert marked with callouts.

    The areas on the alert form are described in the following table.
    Table 5. Alert form areas
    Feature Description
    (A) Tab Each record you click opens in a new tab within Workspace. A tab view of records makes it easier to navigate work in your queue.
    (B) Details tab The Details tab includes form fields, where you can save and complete forms similar to the platform.

    The header in the details tab includes these details:

    • Description: The text from the Description field of the alert is displayed.
    • Updated: Date and time when the alert was updated.
    • Source: The text from the Source field of the alert is displayed.
    • Overall Event Count: The total overall number of events related to this alert.
    • Role in group (None/Primary/Secondary): The role that the selected alert has in the alert group.
    • Group (None/CMDB/Manual/Automated): The group that the selected alert is a member of.
    (C) Form The following components make up a form:
    • A header, which gives a quick glance of alert details and priority information.
    • A ribbon, which shows additional alert information. The ribbon includes two widgets: Alert and Alert Group Timeline.
    • The alert body, which gives a complete view of the alert information.
    • Related lists, which show additional related information at the bottom of the form.
    Agent Assist attachment panel Agent Assist displays relevant knowledge base (KBs) articles for the current alert to find information that might help in solving the alert. Use contextual search to find relevant knowledge base articles. Add the knowledge base articles as attachments to the alert, for example, supporting information to a customer issue.
    (E) Details area The details of the alert record are displayed in this area.

    Included in the details is the Overall Event Count: The total overall number of events related to this alert. The Overall Event Count may differ from the number of events, as the overall count includes historic events related to this alert which are no longer kept in the events table.

    You can also assign the alert to be handled by an individual or group in the Assigned to and Assignment group fields.

    Alert section of the information ribbon
    The Alert widget displays on the left-hand side of the information ribbon and is depicted in the following image.

    Alert ribbon

    Table 6. Alert widget contents
    Feature Description
    Priority Priority group category of the alert. For more information about priority groups, see Priority group.
    CI or Node The CI or node that is bound to the alert. Click the CI or node to open it in a subtab.
    Severity Display the severity status of the alert.
    Actions Displays actions that were defined in Alert Management. For more information about actions to resolve alerts, see Apply a quick response in an alert.
    Feedback Submit your feedback about the usefulness of the alert group. Feedback can help future analysis and, over time, accumulated feedback continues to improve the accuracy of alert aggregation.

    This link appears only when viewing the primary alert in a group.

    Task Open the underlying incident, change request, or problem. The task opens in a subtab.
    Timeline section of the information ribbon
    The Timeline widget, which displays on the right-hand side of the information ribbon, shows the Alert Group Timeline. For further information about the Alert Group Timeline, see Timeline information.
    Collapse information ribbon
    Click the Collapse alert information ribbon to toggle the display of the alert and timeline ribbon.
    Functions at the top of the alert form
    Actions that can be performed in the alert form are listed in the following table.
    Table 7. Alert form actions
    Action Description
    Insight Retrieve and display Alert Insight details. For more information about Alert Insight, see View alert insight information in Workspace.
    Save Update the selected alert.
    Quick Incident Create an incident that is linked to the selected alert.
    Close Close the selected alert.
    Inform Customer Service Create an internally reported case.
    Alert cap icon Toggle the display of the Agent Assist sidebar. For more information about Agent Assist, see Using Agent Assist in Agent Workspace.
    Alert Management Executions
    The entries in this section provide a reference to the actions that have been performed concerning alert management rules. For more information about alert executions, see Alert executions information.
    Remediation Tasks
    A remediation task is automatically created to capture every remediation that was applied to a CI or to an alert. For more information, see View remediation tasks.
    Post comments in the Activity area
    In the Activity area of alerts in Workspace, you can post comments or attach a solution.
    1. In the Activity area of an alert, select Additional comments to make your entry visible to customers, or select Work notes to keep the entry internal.

      Additional comments

    2. In the selected comment field, write a comment or attach a solution and then click Post.
    Related tasks
    • Set up filtered lists in a workspace

    Tags:

    Feedback
    On this page

    Previous topic

    Next topic

    • Contact Us
    • Careers
    • Terms of Use
    • Privacy Statement
    • Sitemap
    • © ServiceNow. All rights reserved.

    Release version
    Choose your release version

      Manage alert lists in Operator Workspace

      • Save as PDF Selected topic Topic & subtopics All topics in contents
      • Unsubscribe Log in to subscribe to topics and get notified when content changes.
      • Share this page

      Manage alert lists in Operator Workspace

      Lists that are specific to Event Management alerts in Operator Workspace are provided in the base system and are located in the Lists panel.

      Alert lists in Workspace

      Filtered lists
      Event Management provides lists that are filtered into various categories. Click the required filtered list in Operator Workspace to display the alerts that you need.
      1. In the Workspace navigation bar, click List icon.

        The Lists panel displays the default Event Management categorized lists.


        Alert lists in workspace

      2. In the Lists panel, under Alerts, the default filters are:
        Table 1. Provided alert filters
        Filter Description
        Top Priority Open alerts that are in the highest Priority group category.
        Top Severity Open alerts that have the highest Severity.
        Open Alerts Open alerts.
        Acknowledged Alerts Alerts whose Acknowledged field has been selected.
        All Alerts Open and closed alerts.
        Assigned to me Alerts assigned to the logged in user.
        Note: Perform all actions on alerts from the All Alerts tab, which does not refresh automatically. If you perform actions on another tab while the list refreshes, your action is cancelled.
      Create a filtered list
      You can create a list filtered according to your requirements, and you can save the list using an easy-to-identify name.
      1. In the Workspace navigation bar, click My Lists.
      2. At the bottom of the Lists panel, click New list.
      3. On the form, fill in the fields.
        Table 2. New List form
        Filter Description
        List name Name for the custom list.
        Table Database table from which the alert list fields are to be populated.
        Conditions Conditions that you define to select the required fields for the alert list.
        Columns Columns to be displayed in the alert list, chosen from the selected database table.
      4. Click Save.

        In the Workspace navigation bar, the new custom filtered list appears in the My Lists pane.

      Alert list functions
      You can select one or more alerts on the alert list and click the relevant button on the top of the form:
      Table 3.
      Button name Description
      Acknowledge Acknowledge the alerts to indicate that they require attention.
      Maintenance Place the alerts in maintenance to indicate that the alert's CI is in the Maintenance state.
      Close Close the alerts.
      Assign to me Assign the alerts to the logged in user.
      Configure alert list refresh
      By default, alerts in the alert lists are automatically updated (auto-refresh) whenever an action is performed on an alert. You can configure the amount of time, in seconds, after which the alert list refreshes when an action is performed.

      You can also disable auto-refresh and configure how often the alert list is updated. This is useful when many alerts are being processed continuously, so that the list is not constantly refreshing.

      1. In the navigation pane, enter sys_properties_list.do in the search field.
      2. To change the alert list refresh time, modify these properties:
        Table 4. Properties to configure alert list refresh
        Property Description
        evt_mgmt.ai_refresh_time_to_wait_after_manual_action Alert list refresh time (in seconds) after a manual action has been performed on the alert.
        evt_mgmt.ai_refresh_time_interval Amount of time (in seconds) after which alert list refreshes, regardless of whether any action was performed on the alerts.

      You can create a new list on the Alert Lists Auto Refresh page by entering em_alert_lists_auto_refresh.list in the navigation pane. Clear the Enable Refresh option so that the list does not refresh automatically.

      Actions you can perform in lists
      From the list of alerts in Workspace, you can perform the following actions.
      Search the list
      Search just within the list you have open. The list search automatically searches all the columns in the list.
      Note: If any records are hidden or removed due to security access restrictions, you see a message with the number of records that were hidden.
      Sort columns
      Click the column headings to determine the sort order of a column. The arrow next to the column name indicates the current sort order. A downward pointing arrow indicates that the column is sorted in descending order. Only the primary sort order is indicated. The system remembers the most recent sort order that you choose for a specific column.

      Column sorting follows the same default behavior as the platform. If a column is not currently sorted, it sorts ascending unless the column data type is a Date. Dates are sorted as descending by default.

      Change the number of rows per page
      In the list footer, click the <Number> rows per page button and select the number of rows you want to display.
      Open a record
      Click anywhere in the row to open a record. The list closes and the record opens in a new tab.
      Tab levels in an alert form
      There are two levels of tabs in the alert form in the Workspace page.
      Highest tab level
      The alert number of the open alert displays in the highest tab level. The alert number of each subsequent alert that you open displays in its own tab. You can open up to 10 tabs.

      Alert tab in workspace

      Secondary tab level
      In the alert form, click an object to open it in a secondary level tab. In the second level, you can have tabs that show, for example, details of the alert, related task (Incident) of the alert, or related CI of the alert.

      Secondary alert tab in workspace

      Alert state
      If an alert is in Closed state and is changed to Open, after saving the alert and refreshing the alert record, the Actions button shows in the alert ribbon.

      A user with the role of evt_mgmt_admin can change the state of an alert.

      To change the state of an alert from Closed to Open:

      1. Select the required alert in the alert list.
      2. In the Details tab, in the State area, select Open and click Save.

        The Actions button shows in the alert ribbon.

        Alert ribbon Action button

      View a topology service map
      You can view a topology map of all services affected by an alert. Click the Actions button for the alert and select Dependency View. For details on the topology map, see View monitored services.
      Create a major incident from an alert
      When an alert meets the criteria set in the Alert Filter tab (on the legacy UI), you can create a major incident for the alert. Click the Actions button for the alert and select Major Incident. For details on managing major incidents, see Major incident management.
      When using the integration between the Customer Service Management and Event Management applications, you can activate an alert rule to automatically create a proactive case from an alert when an incident is created. For more details, see Activate an alert rule to automatically create a proactive case from an alert.
      Create a case from an alert
      Customer Service Management provides an integration with ITOM Event Management. This integration enables you to improve the customer experience by breaking down the silos that exist between the processes and systems used by front line customer service and back-office operations teams. By monitoring issues and creating cases proactively, you can better correlate customer issues and provide faster responses.
      If you are using the integration between the Customer Service Management and Event Management applications, you can create a case for customer install base affected by an alert. For more details, see Manually create a proactive case from an alert.
      View alert record details
      To view the details of an alert record, click an alert in an alert list.

      The following graphic depicts the details of an alert that is in Open state.

      Alert marked with callouts.

      The areas on the alert form are described in the following table.
      Table 5. Alert form areas
      Feature Description
      (A) Tab Each record you click opens in a new tab within Workspace. A tab view of records makes it easier to navigate work in your queue.
      (B) Details tab The Details tab includes form fields, where you can save and complete forms similar to the platform.

      The header in the details tab includes these details:

      • Description: The text from the Description field of the alert is displayed.
      • Updated: Date and time when the alert was updated.
      • Source: The text from the Source field of the alert is displayed.
      • Overall Event Count: The total overall number of events related to this alert.
      • Role in group (None/Primary/Secondary): The role that the selected alert has in the alert group.
      • Group (None/CMDB/Manual/Automated): The group that the selected alert is a member of.
      (C) Form The following components make up a form:
      • A header, which gives a quick glance of alert details and priority information.
      • A ribbon, which shows additional alert information. The ribbon includes two widgets: Alert and Alert Group Timeline.
      • The alert body, which gives a complete view of the alert information.
      • Related lists, which show additional related information at the bottom of the form.
      Agent Assist attachment panel Agent Assist displays relevant knowledge base (KBs) articles for the current alert to find information that might help in solving the alert. Use contextual search to find relevant knowledge base articles. Add the knowledge base articles as attachments to the alert, for example, supporting information to a customer issue.
      (E) Details area The details of the alert record are displayed in this area.

      Included in the details is the Overall Event Count: The total overall number of events related to this alert. The Overall Event Count may differ from the number of events, as the overall count includes historic events related to this alert which are no longer kept in the events table.

      You can also assign the alert to be handled by an individual or group in the Assigned to and Assignment group fields.

      Alert section of the information ribbon
      The Alert widget displays on the left-hand side of the information ribbon and is depicted in the following image.

      Alert ribbon

      Table 6. Alert widget contents
      Feature Description
      Priority Priority group category of the alert. For more information about priority groups, see Priority group.
      CI or Node The CI or node that is bound to the alert. Click the CI or node to open it in a subtab.
      Severity Display the severity status of the alert.
      Actions Displays actions that were defined in Alert Management. For more information about actions to resolve alerts, see Apply a quick response in an alert.
      Feedback Submit your feedback about the usefulness of the alert group. Feedback can help future analysis and, over time, accumulated feedback continues to improve the accuracy of alert aggregation.

      This link appears only when viewing the primary alert in a group.

      Task Open the underlying incident, change request, or problem. The task opens in a subtab.
      Timeline section of the information ribbon
      The Timeline widget, which displays on the right-hand side of the information ribbon, shows the Alert Group Timeline. For further information about the Alert Group Timeline, see Timeline information.
      Collapse information ribbon
      Click the Collapse alert information ribbon to toggle the display of the alert and timeline ribbon.
      Functions at the top of the alert form
      Actions that can be performed in the alert form are listed in the following table.
      Table 7. Alert form actions
      Action Description
      Insight Retrieve and display Alert Insight details. For more information about Alert Insight, see View alert insight information in Workspace.
      Save Update the selected alert.
      Quick Incident Create an incident that is linked to the selected alert.
      Close Close the selected alert.
      Inform Customer Service Create an internally reported case.
      Alert cap icon Toggle the display of the Agent Assist sidebar. For more information about Agent Assist, see Using Agent Assist in Agent Workspace.
      Alert Management Executions
      The entries in this section provide a reference to the actions that have been performed concerning alert management rules. For more information about alert executions, see Alert executions information.
      Remediation Tasks
      A remediation task is automatically created to capture every remediation that was applied to a CI or to an alert. For more information, see View remediation tasks.
      Post comments in the Activity area
      In the Activity area of alerts in Workspace, you can post comments or attach a solution.
      1. In the Activity area of an alert, select Additional comments to make your entry visible to customers, or select Work notes to keep the entry internal.

        Additional comments

      2. In the selected comment field, write a comment or attach a solution and then click Post.
      Related tasks
      • Set up filtered lists in a workspace

      Tags:

      Feedback

          Share this page

          Got it! Feel free to add a comment
          To share your product suggestions, visit the Idea Portal.
          Please let us know how to improve this content

          Check any that apply

          To share your product suggestions, visit the Idea Portal.
          Confirm

          We were unable to find "Coaching" in Jakarta. Would you like to search instead?

          No Yes
          • Contact Us
          • Careers
          • Terms of Use
          • Privacy Statement
          • Sitemap
          • © ServiceNow. All rights reserved.

          Subscribe Subscribed Unsubscribe Last updated: Tags: January February March April May June July August September October November December No Results Found Versions Search preferences successfully updated My release version successfully updated My release version successfully deleted An error has occurred. Please try again later. You have been unsubscribed from all topics. You are now subscribed to and will receive notifications if any changes are made to this page. You have been unsubscribed from this content Thank you for your feedback. Form temporarily unavailable. Please try again or contact  docfeedback@servicenow.com  to submit your comments. The topic you requested does not exist in the release. You were redirected to a related topic instead. The available release versions for this topic are listed There is no specific version for this documentation. Explore products Click to go to the page. Release notes and upgrades Click to open the dropdown menu. Delete Remove No selected version Reset This field is required You are already subscribed to this topic Attach screenshot The file you uploaded exceeds the allowed file size of 20MB. Please try again with a smaller file. Please complete the reCAPTCHA step to attach a screenshot
          Log in to personalize your search results and subscribe to topics
          No, thanks Login