Alert Management Rules Not Triggering — Common Causes and Resolutions - Support and Troubleshooting

Alert Management Rules Not Triggering — Common Causes and Resolutions Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Alert Management Rules do not trigger as expected. Symptoms may include:

No rule execution records created No subflows running Logs showing Execution map is: {} Alerts not being acknowledged or updated with work notes despite matching an active rule's filter Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ANY

Cause .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } There are two distinct reasons Alert Management Rules may fail to trigger:

Cause 1: Assignment Group mismatch

Alert Management Rules evaluate the Assignment Group as a hard filter before checking the alert filter condition. If a rule has an Assignment Group set, it will apply only to alerts with the same Assignment Group. If the alert's Assignment Group is empty, the rule is skipped entirely — the alert filter is never evaluated.

There are two types of Alert Management Rules:

Global Rules — Assignment Group is empty; apply to all alerts regardless of group. Team-Based Rules — Assignment Group is set to a specific group; it only applies to alerts assigned to that same group. Diagnostic Example: The scheduled job Event Management - Evaluate Scoped Alert Rules Management picks up the alert and identifies a matching rule, but no executions are created. In the job logs, you will see the alert being processed, followed immediately by an empty execution map:

*** Script: Event management debug log- EvtMgmtUpdateAlertMgmtJob EvtMgmtAlertMgmtJob.evaluateAlertsCalc - alerts to process: Alert , created = , updated = , severity= null *** Script: Event management debug log- Execution map is: {} The alert is picked up, and a matching rule is found, but the execution map remains empty because the Assignment Group on the rule does not match the Assignment Group on the alert (which may be empty).

Cause 2: A higher-priority rule is blocking evaluation

Alert Management Rules are evaluated in execution order. If a rule with a lower order number (higher priority) matches an alert and is configured with "Stop search for additional rules", no subsequent rules will be evaluated for that alert — even if they would otherwise match.

Additionally, if that blocking rule has a subflow action that fails silently (e.g., no work notes written, no acknowledgment recorded), it may appear as though no rules ran at all.

Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } For Cause 1 — Assignment Group mismatch:

Option 1 (Recommended): Clear the Assignment Group field on the Alert Management Rule to make it global. The rule will then apply to all alerts regardless of group. Option 2: Ensure your alert source or integration populates the Assignment Group on incoming alerts with a value matching the rule. Option 3 (Mixed approach): Use global rules for broad automation and reserve team-based rules only for scenarios where alerts are guaranteed to have an Assignment Group set. For Cause 2 — Rule execution order blocking:

Navigate to Event Management > Alert Management Rules and review the execution order of active rules. Identify any rule with a low order number that has "Stop search for additional rules" enabled and whose filter may be matching your alerts unintentionally. If the blocking rule contains subflow actions, verify those subflows are executing correctly by checking flow execution logs and confirming work notes or other expected outputs are being written to the alert. Adjust execution order or broaden/narrow filter conditions as needed to ensure rules trigger in the intended sequence.