On Alert [em_alert] Maintenance flag is updated to False automatically when a new event comes inIssue The Alerts "Maintenance" field may seem to be updated to on/off without clear logic. This flag may be switched to active for an alert; however, when a new event associated with this alert comes in, the maintenance flag on the alert gets unchecked. An alert flag will be activated when either when the CI associated with the alert status is set to "In Maintenance" or when an active Change Request for the CI meets the following conditions: - State is Scheduled or Implement - Change Request current time is between the "planned start date" and "planned end date" or between the "actual start date" and "actual end date" When a child CI is put into maintenance, the parent CI switches to maintenance as well; therefore, for CIs such as a Business Service, the maintenance field will alternate from true to false or false to true more often. If an alert is not associated with a CI, or the associated CI is not in the "In Maintenance" state, the "maintenance" flag on the alert is unchecked during the whole event processing. Related LinksThis behavior is by design. More information can be found in the documentation pages below: How Alerts Work with CI(s) in Maintenance: https://docs.servicenow.com/csh?topicname=c_EMHowImpactTree.html&version=latest Create Maintenance Rule: https://docs.servicenow.com/csh?topicname=create-maintenance-rule.html&version=latest