{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":30517,"path":"it-operations-management/event-management/operator-phase-triage-incident.md","title":null,"bundle":null,"doc_type":null,"release":null,"body":"---\ntitle: Operator phase 2: Triage an alert\ndescription: After you analyze and acknowledge an alert, you must triage it. The triage phase involves verifying alert correlation and taking an action to help resolve the issue that caused the alert. This topic covers the most common triage task: creating an incident from an alert.\nlocale: en-US\ncanonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/event-management/operator-phase-triage-incident.html\nrelease: australia\nproduct: Event Management\nclassification: event-management\ntopic_type: task\nlast_updated: \"2026-03-12\"\nreading_time_minutes: 6\nbreadcrumb: [Operator responsibilities, Event Management Operator Tutorial, Use, Event Management, ITOM AIOps, IT Operations Management]\n---\n\n# Operator phase 2: Triage an alert\n\nAfter you analyze and acknowledge an alert, you must triage it. The triage phase involves verifying alert correlation and taking an action to help resolve the issue that caused the alert. This topic covers the most common triage task: creating an incident from an alert.\n\n## Before you begin\n\n**Note:** The Operator Workspace interface is available only to customers who have upgraded from a release prior to the Utah release. New customers as of the Utah release can use the Service Operations Workspace for ITOM, which offers an enhanced UI for managing alerts.\n\n\n
\n\nPhase 1\n\n\n\n\\[Omitted image \"progress-complete2.png\"\\] Alt text: Analyze icon\n\n\n\n[Analyze and acknowledge an alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-phase-acknowledge-analyze.md)\n\n
\n\nPhase 2\n\n\n\n\\[Omitted image \"progress-wip.png\"\\] Alt text: Triage icon\n\n\n\nTriage alerts\n\n
\n\nPhase 3\n\n\n\n\\[Omitted image \"progress-not-started.png\"\\] Alt text: Close alert icon\n\n\n\n[Close an alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-close-alert.md)\n\n
Role required: evt\\_mgmt\\_operator\n\n## Procedure\n\n1. Before you start to work on the alert, check whether other alerts should be correlated with the one you just reviewed:\n\n 1. Navigate to **Event Management** > **Service Operations Workspace**.\n\n 2. Click the same application service tile and review the alerts in the **Alerts** list.\n\n 3. If multiple alerts are present, open one to determine if it is related to the other alert, or if the underlying issue is the same in both alerts.\n\n For example, an alert might be associated with a web server while another alert exists for a database issue. Correlate the web server alert as a secondary alert with the database alert as the primary alert.\n\n 4. Open the secondary alert, click the lookup icon \\(\\[Omitted image \"lookup-icon.png\"\\] Alt text: Lookup icon\\) in the **Parent** field, and then select the primary alert.\n\n This creates a primary \\(parent\\) / secondary \\(child\\) relationship between the two alerts.\n\n \\[Omitted image \"operator-alert-parent.png\"\\] Alt text: Alert\n\n 5. Repeat this process to correlate as many secondary alerts as necessary.\n\n 6. Navigate back to the Service Operations Workspace dashboard and verify that the primary alert displays an icon in the **Group** column.\n\n \\[Omitted image \"operator-dashbaord-alert-group.png\"\\] Alt text: Group\n\n **Note:** Your administrator can set up rules that let the system automatically correlate alerts so that you do not need to do so manually. In that case, a **Feedback** field appears on the Alert form. Select **Yes** if the system correlated the alert correlated correctly, or **No** if not. Currently, the feedback option is available but does not trigger further actions after being logged.\n\n2. Open the primary alert.\n\n3. On the Alert form, click **Actions** > **Create Incident**.\n\n If your organization uses Security Incident Response, the button is **Create Security incident**.\n\n The Flow Designer opens.\n\n \\[Omitted image \"flow-designer-executions-tab.png\"\\] Alt text: Creating an incident\n\n4. Click **Refresh**.\n\n The **Execution Details** page opens.\n\n \\[Omitted image \"execution-details-page.png\"\\] Alt text: Execution Details page\n\n5. Click **Open Context Record** and then fill in the Incident form.\n\n \\[Omitted image \"incident-form.png\"\\] Alt text: Incident form\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nCaller\n\n\n\nClick the lookup icon \\(\\[Omitted image \"lookup-icon.png\"\\] Alt text: Lookup icon\\) and then select your name. The caller is the person who discovered the issue that led to the incident.\n\n
\n\nCategory and Subcategory\n\n\n\nSelect a category that best describes this alert. In this example, **Database** is the best choice.\n\n
\n\nApplication service\n\n\n\nSelect the application service to which the CI belongs. In this example, the application service is **Web portal**.\n\n
\n\nConfiguration item\n\n\n\nIf it is not already populated, select the CI. In this example, the Oracle database \\(**PS ORA01**\\) is automatically populated into the field.\n\n
\n\nImpact and Urgency\n\n\n\nSelect the impact and urgency levels that you think appropriate.\n\n
\n\nAssignment group\n\n Assigned to\n\n\n\nClick the lookup icons \\(\\[Omitted image \"lookup-icon.png\"\\] Alt text: Lookup icon\\) for both or either of these fields, and then select the group or the individual that can handle the issue.\n\n
6. Click **Submit** to create the incident.\n\n The Alert you are working on reappears. On the Alert form, the incident is populated in the **Task** field. You can also see the incident number in the Task column on the Service Operations Workspace dashboard.\n\n \\[Omitted image \"operator-alert-task.png\"\\] Alt text: Alert\n\n\n## What to do next\n\nThere are other tasks you perform as part of the triage stage:\n\n- [Run a remediation workflow on an alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-run-remdiation.md) if your Event Management administrator already set up a workflow in your ServiceNow instance and your policies allow you to trigger it from the alert.\n- [Launch a web application from an alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-launch-web-app.md) to open a website or an event monitoring tool that provides more information about the alert.\n- [Associate a knowledge base article with an alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-associate-kb.md) if there is existing information about the alert that might help resolve the underlying issue.\n- [Put an alert into maintenance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-put-alert-into-maintenance.md) to temporarily hide it from the Service Operations Workspace dashboard if the alert does not require action at this time.\n\nIf you do not need to perform any other triage actions, proceed to [Phase 3: Close an alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-close-alert.md).\n\n- **[Run a remediation workflow on an alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-run-remdiation.md)** \nAs an Event Management operator, you can also run a workflow on your ServiceNow instance that helps remediate the alert. For example, you might run a workflow that automatically restarts a server on your network, which might resolve an alert about CPU usage.\n- **[Launch a web application from an alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-launch-web-app.md)** \nAs an Event Management operator, you can also launch a web application from an alert. The web application might be a console for your event monitoring tool or any external website with additional alert information.\n- **[Associate a knowledge base article with an alert](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-associate-kb.md)** \nAs an Event Management operator, you can associate a knowledge base \\(KB\\) article with the alert to capture additional information about the alert. This might include a procedure that someone has to follow to resolve the underlying issue on your network, or a best practice to prevent the issue from reoccurring.\n- **[Put an alert into maintenance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-put-alert-into-maintenance.md)** \nAs an Event Management operator, you can put an alert into maintenance if the alert does not require further action but you want to keep it active. Putting the alert into maintenance hides it from the Service Operations Workspace dashboard so that other operators do not need to access it, but it does not close the alert.\n\n**Parent Topic:**[What Event Management operators do](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-process.md)\n\n"}}