{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":30207,"path":"it-operations-management/event-management/Alert-Groups.md","title":"Alert grouping types and creation methods","bundle":null,"doc_type":null,"release":"australia","body":"\n# Alert grouping types and creation methods\n\nExplore different alert grouping types, understand their descriptions, and learn about their creation methods to enhance problem identification and streamline alert management.\n\n## Viewing and managing alert groups\n\nNavigate to **Event Management** > **All Alerts** to view all alert groups. The icon in the **Group** column denotes the alert group type, while alerts not associated with any group have no entry in the **Group** column. Double-click the **Group** column to open the Grouped Alerts dialog, where you can view all alerts in the group and manually add or remove alerts.\n\n**Note:** An alert can belong to only one alert group at a time.\n\n## Types of alert grouping\n\n\n
\n\nType\n\n\n\nIcon\n\n\n\nDescription\n\n\n\nCreation method\n\n\n\nAdditional information\n\n
\n\nLog Analytics\n\n\n\nL\n\n\n\nLog Analytics groups are formed when the system identifies multiple related Log Analytics alerts, grouping them based on their significant connections.\n\n\n\nCreated as part of log analytics event processing.\n\n\n\n[Kinds of Health Log Analytics alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-op-log-analytics-alert-types.md)\n\n
\n\nRule-based\n\n\n\nR\n\n\n\nRule-based groups consist of related alerts that are organized based on compliance with alert correlation rules, which determine how alerts are grouped according to their relationships.\n\n\n\nCreated via business rule \\(Calculate correlation rule\\) on em\\_alert table when alert is created or updated.\n\n\n\n- [Rule-based alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/c_EMEventCorrelationRules.md)\n- [Create an alert correlation rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/t_EMConfigureAnEventCorrelationRule.md)\n\n
\n\nAutomated\n\n\n\nA\n\n\n\nAutomated groups are formed by alert aggregation and include a virtual alert as the primary alert of the group. An Aggregated automated group is created when two or more alerts share the same CI type and metric name.\n\n\n\nCreated via scheduled job.\n\n\n\n[Automated alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/c_SACorrelatedAlertGroups.md)\n\n
\n\nCMDB\n\n\n\nC\n\n\n\nCMDB groups are formed based on CI relationships in the CMDB, specifically for CIs that are not included in rule-based or automated groups.\n\n\n\nCreated via scheduled job.\n\n\n\n[CMDB based alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/cmdb-alert-groups.md)\n\n
\n\nNetwork traffic based\n\n\n\nN\n\n\n\nNetwork traffic alert groups are formed by analyzing network traffic connections between processes across hosts. This method leverages service candidates identified through ML Service Mapping to group alerts related to network traffic issues.\n\n\n\nCreated via scheduled job.\n\n\n\n[Network traffic based alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/network-traffic-correlation-grouping.md)\n\n
\n\nText\n\n\n\nT\n\n\n\nText groups are formed by grouping alerts based on similar text from frequently used words in following fields.- Description\n- Metric Name\n- CI Class\n\n\n\nCreated via scheduled job.\n\n\n\n[Text-based alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/text-based-alert-groups.md)\n\n
\n\nTag Cluster\n\n\n\nTag\n\n\n\nTag Cluster groups are formed by grouping alerts according to user-defined tag-based alert clustering definitions.\n\n\n\nCreated via scheduled job.\n\n\n\n[Tag cluster alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/alert-clustering-tag-definitions-concept.md)\n\n
\n\nShared Impacted Services\n\n\n\nImpacted Services\n\n\n\nShared Impacted Services groups consist of related alerts that are automatically clustered based on a shared Top Service — the highest-priority Business Service linked to each alert's configuration item.\n\n\n\nCreated automatically by the alert grouping job when alerts resolve to the same Top Service.\n\n\n\n[Shared impacted services alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/shared-impacted-services-grouping.md)\n\n
\n\nManual\n\n\n\nM\n\n\n\nAlerts grouped manually by users to organize related issues.\n\n\n\nCreated manually by the user.\n\n\n\n[Manual alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/t_SAAddAlertCorrelatedAlertGrp.md)\n\n
For information on scheduled jobs and parameters, refer to [Scheduled jobs and parameters for alert grouping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/alert-grp-jobs-parameters.md). For detailed information on configuring alert correlation logic order, see [Configure alert correlation logic order](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/configure-alert-correlation-logic-order.md).\n\n"}}