How to stop copying severity from additional information on the event to alertDescription When creating an event transform in the event rules to map severity to a static value, the severity from transform never gets populated into the alert and is replaced by the severity field on the additional information. ResolutionAdditional field information from event to Alert is copied after the event transformation rules run. Copying information from the additional information is the last action it does before creating a alert. There is sys_property evt_mgmt.alert_black_list_fields to define what to copy from the event to the alert. This way the event transformations are not overwritten by some of the fields in the additional information. Navigate to https://<yourinstance>.service-now.com/sys_properties_list.doAdd the property evt_mgmt.alert_black_list_fields if it does not exist.In the value, add severity or any other fields you do not want to copy from the additional information on the event to alert. For additional information please refer to populate custom alert fields