Alert lists in Workspace

Filtered lists

Event Management provides lists that are filtered into various categories. Click the required filtered list in Operator Workspace to display the alerts that you need.

1. In the Workspace navigation bar, click .

   The Lists panel displays the default Event Management categorized lists.

   
   

   

   
   
2. In the Lists panel, under Alerts, the default filters are:

   Table 1. Provided alert filters

   Filter	Description
   Top Priority	Open alerts that are in the highest Priority group category.
   Top Severity	Open alerts that have the highest Severity.
   Open Alerts	Open alerts.
   Acknowledged Alerts	Alerts whose Acknowledged field has been selected.
   All Alerts	Open and closed alerts.
   Assigned to me	Alerts assigned to the logged in user.

   Note: Perform all actions on alerts from the All Alerts tab, which does not refresh automatically. If you perform actions on another tab while the list refreshes, your action is cancelled.

Create a filtered list

You can create a list filtered according to your requirements, and you can save the list using an easy-to-identify name.

1. In the Workspace navigation bar, click My Lists.
2. At the bottom of the Lists panel, click New list.
3. On the form, fill in the fields.

   Table 2. New List form

   Filter	Description
   List name	Name for the custom list.
   Table	Database table from which the alert list fields are to be populated.
   Conditions	Conditions that you define to select the required fields for the alert list.
   Columns	Columns to be displayed in the alert list, chosen from the selected database table.

4. Click Save.

   In the Workspace navigation bar, the new custom filtered list appears in the My Lists pane.

Alert list functions

You can select one or more alerts on the alert list and click the relevant button on the top of the form:

Table 3.

Button name	Description
Acknowledge	Acknowledge the alerts to indicate that they require attention.
Maintenance	Place the alerts in maintenance to indicate that the alert's CI is in the Maintenance state.
Close	Close the alerts.
Assign to me	Assign the alerts to the logged in user.

Configure alert list refresh

By default, alerts in the alert lists are automatically updated (auto-refresh) whenever an action is performed on an alert. You can configure the amount of time, in seconds, after which the alert list refreshes when an action is performed.

You can also disable auto-refresh and configure how often the alert list is updated. This is useful when many alerts are being processed continuously, so that the list is not constantly refreshing.

1. In the navigation pane, enter sys_properties_list.do in the search field.
2. To change the alert list refresh time, modify these properties:

   Table 4. Properties to configure alert list refresh

   Property	Description
   evt_mgmt.ai_refresh_time_to_wait_after_manual_action	Alert list refresh time (in seconds) after a manual action has been performed on the alert.
   evt_mgmt.ai_refresh_time_interval	Amount of time (in seconds) after which alert list refreshes, regardless of whether any action was performed on the alerts.

You can create a new list on the Alert Lists Auto Refresh page by entering em_alert_lists_auto_refresh.list in the navigation pane. Clear the Enable Refresh option so that the list does not refresh automatically.

Actions you can perform in lists

From the list of alerts in Workspace, you can perform the following actions.

Search the list

Search just within the list you have open. The list search automatically searches all the columns in the list.

Note: If any records are hidden or removed due to security access restrictions, you see a message with the number of records that were hidden.

Sort columns

Click the column headings to determine the sort order of a column. The arrow next to the column name indicates the current sort order. A downward pointing arrow indicates that the column is sorted in descending order. Only the primary sort order is indicated. The system remembers the most recent sort order that you choose for a specific column.

Column sorting follows the same default behavior as the platform. If a column is not currently sorted, it sorts ascending unless the column data type is a Date. Dates are sorted as descending by default.

Change the number of rows per page

In the list footer, click the <Number> rows per page button and select the number of rows you want to display.

Open a record

Click anywhere in the row to open a record. The list closes and the record opens in a new tab.

Tab levels in an alert form

There are two levels of tabs in the alert form in the Workspace page.

Highest tab level

The alert number of the open alert displays in the highest tab level. The alert number of each subsequent alert that you open displays in its own tab. You can open up to 10 tabs.

Secondary tab level

In the alert form, click an object to open it in a secondary level tab. In the second level, you can have tabs that show, for example, details of the alert, related task (Incident) of the alert, or related CI of the alert.

Alert state

If an alert is in Closed state and is changed to Open, after saving the alert and refreshing the alert record, the Actions button shows in the alert ribbon.

A user with the role of evt_mgmt_admin can change the state of an alert.

To change the state of an alert from Closed to Open:

1. Select the required alert in the alert list.
2. In the Details tab, in the State area, select Open and click Save.

   The Actions button shows in the alert ribbon.

   

View a topology service map

You can view a topology map of all services affected by an alert. Click the Actions button for the alert and select Dependency View. For details on the topology map, see View monitored services.

Create a major incident from an alert

When an alert meets the criteria set in the Alert Filter tab (on the legacy UI), you can create a major incident for the alert. Click the Actions button for the alert and select Major Incident. For details on managing major incidents, see Major incident management.

When using the integration between the Customer Service Management and Event Management applications, you can activate an alert rule to automatically create a proactive case from an alert when an incident is created. For more details, see Activate an alert rule to automatically create a proactive case from an alert.

Create a case from an alert

Customer Service Management provides an integration with ITOM Event Management. This integration enables you to improve the customer experience by breaking down the silos that exist between the processes and systems used by front line customer service and back-office operations teams. By monitoring issues and creating cases proactively, you can better correlate customer issues and provide faster responses.

If you are using the integration between the Customer Service Management and Event Management applications, you can create a case for customer install base affected by an alert. For more details, see Manually create a proactive case from an alert.

View alert record details

To view the details of an alert record, click an alert in an alert list.

The following graphic depicts the details of an alert that is in Open state.

The areas on the alert form are described in the following table.

Table 5. Alert form areas

Feature	Description
(A) Tab	Each record you click opens in a new tab within Workspace. A tab view of records makes it easier to navigate work in your queue.
(B) Details tab	The Details tab includes form fields, where you can save and complete forms similar to the platform. The header in the details tab includes these details: Description: The text from the Description field of the alert is displayed. Updated: Date and time when the alert was updated. Source: The text from the Source field of the alert is displayed. Overall Event Count: The total overall number of events related to this alert. Role in group (None/Primary/Secondary): The role that the selected alert has in the alert group. Group (None/CMDB/Manual/Automated): The group that the selected alert is a member of.
(C) Form	The following components make up a form: A header, which gives a quick glance of alert details and priority information. A ribbon, which shows additional alert information. The ribbon includes two widgets: Alert and Alert Group Timeline. The alert body, which gives a complete view of the alert information. Related lists, which show additional related information at the bottom of the form.
Agent Assist attachment panel	Agent Assist displays relevant knowledge base (KBs) articles for the current alert to find information that might help in solving the alert. Use contextual search to find relevant knowledge base articles. Add the knowledge base articles as attachments to the alert, for example, supporting information to a customer issue.
(E) Details area	The details of the alert record are displayed in this area. Included in the details is the Overall Event Count: The total overall number of events related to this alert. The Overall Event Count may differ from the number of events, as the overall count includes historic events related to this alert which are no longer kept in the events table. You can also assign the alert to be handled by an individual or group in the Assigned to and Assignment group fields.

Alert section of the information ribbon

The Alert widget displays on the left-hand side of the information ribbon and is depicted in the following image.

Table 6. Alert widget contents

Feature	Description
Priority	Priority group category of the alert. For more information about priority groups, see Priority group.
CI or Node	The CI or node that is bound to the alert. Click the CI or node to open it in a subtab.
Severity	Display the severity status of the alert.
Actions	Displays actions that were defined in Alert Management. For more information about actions to resolve alerts, see Apply a quick response in an alert.
Feedback	Submit your feedback about the usefulness of the alert group. Feedback can help future analysis and, over time, accumulated feedback continues to improve the accuracy of alert aggregation. This link appears only when viewing the primary alert in a group.
Task	Open the underlying incident, change request, or problem. The task opens in a subtab.

Timeline section of the information ribbon

The Timeline widget, which displays on the right-hand side of the information ribbon, shows the Alert Group Timeline. For further information about the Alert Group Timeline, see Timeline information.

Collapse information ribbon

Click the to toggle the display of the alert and timeline ribbon.

Functions at the top of the alert form

Actions that can be performed in the alert form are listed in the following table.

Table 7. Alert form actions

Action	Description
Insight	Retrieve and display Alert Insight details. For more information about Alert Insight, see View alert insight information in Workspace.
Save	Update the selected alert.
Quick Incident	Create an incident that is linked to the selected alert.
Close	Close the selected alert.
Inform Customer Service	Create an internally reported case.
	Toggle the display of the Agent Assist sidebar. For more information about Agent Assist, see Using Agent Assist in Agent Workspace.

Alert Management Executions

The entries in this section provide a reference to the actions that have been performed concerning alert management rules. For more information about alert executions, see Alert executions information.

Remediation Tasks

A remediation task is automatically created to capture every remediation that was applied to a CI or to an alert. For more information, see View remediation tasks.

Post comments in the Activity area

In the Activity area of alerts in Workspace, you can post comments or attach a solution.

1. In the Activity area of an alert, select Additional comments to make your entry visible to customers, or select Work notes to keep the entry internal.

   

2. In the selected comment field, write a comment or attach a solution and then click Post.