Alert lists in Workspace

Filtered lists

Event Management provides lists that are filtered into various categories. Click the required filtered list in Operator Workspace to display the alerts that you need.

1. In the Workspace navigation bar, click .

   The Lists panel displays the default Event Management categorized lists.

   
   

   

   
   
2. In the Lists panel, under Alerts, the default filters are:

   Table 1. Provided alert filters

   Filter	Description
   Top Priority	Open alerts that are in the highest Priority group category.
   Top Severity	Open alerts that have the highest Severity.
   Open Alerts	Open alerts.
   Acknowledged Alerts	Alerts whose Acknowledged field has been selected.
   All Alerts	Open and closed alerts.
   Assigned to me	Alerts assigned to the logged in user.

   Note: Perform all actions on alerts from the All Alerts tab, which does not refresh automatically. If you perform actions on another tab while the list refreshes, your action is cancelled.

Create a filtered list

You can create a list filtered according to your requirements, and you can save the list using an easy-to-identify name.

1. In the Workspace navigation bar, click My Lists.
2. At the bottom of the Lists panel, click New list.
3. On the form, fill in the fields.

   Table 2. New List form

   Filter	Description
   List name	Name for the custom list.
   Table	Database table from which the alert list fields are to be populated.
   Conditions	Conditions that you define to select the required fields for the alert list.
   Columns	Columns to be displayed in the alert list, chosen from the selected database table.

4. Click Save.

   In the Workspace navigation bar, the new custom filtered list appears in the My Lists pane.

Alert list functions

You can select one or more alerts on the alert list and click the relevant button on the top of the form:

Table 3.

Button name	Description
Assign to me	Assign the alerts to the logged in user.
Save	Save any changes made to the alert.
Quick incident	Create an incident that is linked to the selected alert. The created incident opens in a standard incident form in a separate window.
Close	Close the alert.
	Toggle the display of the Agent Assist sidebar. For more information about Agent Assist, see Using Agent Assist in Agent Workspace.

Configure alert list refresh

By default, alerts in the alert lists are automatically updated (auto-refresh) whenever an action is performed on an alert. You can configure the amount of time, in seconds, after which the alert list refreshes when an action is performed.

You can also disable auto-refresh and configure how often the alert list is updated. This is useful when many alerts are being processed continuously, so that the list is not constantly refreshing.

1. In the navigation pane, enter sys_properties_list.do in the search field.
2. To change the alert list refresh time, modify these properties:

   Table 4. Properties to configure alert list refresh

   Property	Description
   evt_mgmt.ai_refresh_time_to_wait_after_manual_action	Alert list refresh time (in seconds) after a manual action has been performed on the alert. If multiple actions have been performed, the list refresh time is calculated after the most recent action.
   evt_mgmt.ai_refresh_time_interval	Amount of time (in seconds) after which alert list refreshes, regardless of whether any action was performed on the alerts.

You can create a new list on the Alert Lists Auto Refresh page by entering em_alert_lists_auto_refresh.list in the navigation pane. To prevent automatic refresh of the list, clear the Enable Refresh option.

Actions you can perform in lists

From the list of alerts in Workspace, you can perform the following actions.

Search the list

Search just within the list you have open. The list search automatically searches all the columns in the list.

Note: If any records are hidden or removed due to security access restrictions, you see a message with the number of records that were hidden.

Sort columns

Click the column headings to determine the sort order of a column. The arrow next to the column name indicates the current sort order. A downward pointing arrow indicates that the column is sorted in descending order. Only the primary sort order is indicated. The system remembers the most recent sort order that you choose for a specific column.

Column sorting follows the same default behavior as the platform. If a column is not currently sorted, it sorts ascending unless the column data type is a Date. Dates are sorted as descending by default.

Change the number of rows per page

In the list footer, click the <Number> rows per page button and select the number of rows you want to display.

Open a record

Click the number to open a record. The record opens in a new tab.

Tab levels in an alert form

Following are the levels of tabs in the alert form in the Workspace page.

Highest tab level

The alert number of the open alert displays in the highest tab level. The alert number of each subsequent alert that you open displays in its own tab. The original tab of alert lists displays as the Lists tab on the left-most tab. You can open up to 10 tabs.

Details tab

When selecting an alert, the Details tab appears as a secondary tab, containing information about the alert.

Details sub-tabs

The Details tab also contains sub-tab options with additional information on the alert, such as the alert's impacted services and probable root causes. You can also select the more option on the right for additional information options.

Alert state

If an alert is in Closed state and is changed to Open, after saving the alert and refreshing the alert record, the Actions section appears on the right side of the alert form. The options that appear in the Actions section are determined by the actions configured in Alert Management Rules.

A user with the role of evt_mgmt_admin can change the state of an alert.

To change the state of an alert from Closed to Open:

1. Select the required alert in the alert list.
2. In the Details tab, in the State area, select Open and click Save.

   The Actions section appears on the form.

   
   

   

   
   

View a topology service map

You can view a topology map of all services affected by an alert. In the Actions section on the alert form, locate Dependency View and click Launch app. For details on the topology map, see View monitored services.

Create a major incident from an alert

When an alert meets the criteria set in the Alert Filter tab (on the legacy UI), you can create a major incident for the alert. In the Actions section on the alert form, locate Create Incident and click Run remediation. For details on managing major incidents, see Major incident management.

When using the integration between the Customer Service Management and Event Management applications, you can activate an alert rule to automatically create a proactive case from an alert when an incident is created. For more details, see Activate an alert rule to automatically create a proactive case from an alert.

Create a case from an alert

Customer Service Management provides integration with ITOM Event Management. This integration enables you to improve the customer experience by breaking down the silos that exist between the processes and systems used by front line customer service and back-office operations teams. By monitoring issues and creating cases proactively, you can better correlate customer issues and provide faster responses.

If you are using the integration between the Customer Service Management and Event Management applications, you can create a case for the customer install base affected by an alert. For more details, see Manually create a proactive case from an alert.

View alert record details

To view the details of an alert record, click an alert in an alert list. For details on the displayed alert information, see Alerts in Operator Workspace.

Alert Management Executions

The entries in this section (select more > Alert Executions) provide a reference to the actions that have been performed concerning alert management rules. For more information about alert executions, see Alert executions information.

Remediation Tasks

A remediation task (select more > Remediation Tasks) is automatically created to capture every remediation that was applied to a CI or to an alert. For more information, see View remediation tasks.