Dynatrace event payload contains 'name' and 'correlation_id' fields that override custom event rule CI binding in Service Graph Connector for ObservabilityIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } After installing the Service Graph Connector (SGC) for Observability - Dynatrace, the JSON payload arriving in the' em_event' table from Dynatrace contains 'name' and 'correlation_id' keys. These fields override the configuration item (CI) binding configured through custom event rules, causing alerts to bind to a different CI than expected. Facts<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } - Service Graph Connector for Observability - Dynatrace is installed from the ServiceNow Store.- Dynatrace problem notifications are configured to send to the ServiceNow event collector endpoint.- A custom event rule is configured to bind alerts to a CI based on fields other than 'name' / 'correlation_id'.- The integration uses the out-of-the-box (OOB) Dynatrace problem notification webhook payload Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All currently supported releases. Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } This behavior is by design. The Service Graph Connector for Observability - Dynatrace does not modify, inject, or add fields to the payload that Dynatrace sends to the ServiceNow event collector. The payload arriving at the 'em_event' table is exactly what Dynatrace transmits. Two distinct points are commonly conflated in this scenario: 1. **CI updates vs. event ingestion.** Records entering the 'em_event' table do not pass through the Identification and Reconciliation Engine (IRE) and do not update CI records. They only create rows in 'em_event' and 'em_alert' and attempt to bind each alert to a CI through the'configuration_item' reference field on'em_alert'. CMDB CI updates from Dynatrace flow through a separate Service Graph Connector data source (IntegrationHub ETL) — not through the problem notification webhook. 2. **Source of 'name' and 'correlation_id'.** These fields are not part of the OOB Dynatrace problem notification webhook template. If they appear in the inbound payload, they were added through configuration on the Dynatrace side — typically by editing the webhook payload template in Dynatrace's Problem Notifications configuration. The ServiceNow side passes the payload through unchanged. When 'name' and 'correlation_id' are present in the payload, the platform's default event-to-alert binding logic uses them as a higher-priority match key than the values evaluated by a custom event rule, which is why the rule's CI binding appears to be overridden. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The resolution depends on which behavior is being addressed. Apply the steps that match the scenario. ### Scenario A: Remove 'name' and 'correlation_id' from the inbound payload These fields originate in the Dynatrace webhook template, not in ServiceNow. Engage the Dynatrace administrator or Dynatrace support to: 1. Open the Dynatrace Problem Notifications configuration for the integration sending events to ServiceNow.2. Edit the custom payload template and remove the 'name' and 'correlation_id' keys.3. Save the notification configuration and trigger a test problem to confirm the new payload no longer contains those keys. For the supported Dynatrace webhook integration format, refer to the Dynatrace webhook integration documentation and the Dynatrace alerting profiles documentation ### Scenario B: Adjust CMDB CI field mapping (CI updates only — does not affect event payload) This applies only when the goal is to stop the Service Graph Connector for Dynatrace from updating specific CI fields during CMDB synchronization. It does not change the event payload sent from Dynatrace. 1. Navigate to **All > CMDB Integrations Studio**.2. Open the IntegrationHub ETL transform map for the Dynatrace data source.3. Remove the 'name' or'correlation_id' field mapping from the relevant target class. The OOB Dynatrace-to-CMDB class mappings are listed in the CMDB classes targeted in Service Graph Connector for Observability - Dynatrace 4. Save the transform map and run a test import to confirm the field is no longer updated. **Note:** Modifying OOB IntegrationHub ETL mappings is flagged as a customization. Perform end-to-end regression testing on the integration before promoting changes to production. ### Scenario C: Filter ingested data at the connection level To filter the dataset that the Service Graph Connector ingests rather than modifying field mappings, navigate to **All > Service Graph Connectors > Dynatrace Observability > Connections** and review the available filter properties documented in the Service Graph Connector for Observability - Dynatrace properties