Secondary alerts have no incident in the Task field — expected behavior when 'evt_mgmt.avoid_int_enabled' is enabled<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Title: Secondary alerts have an empty Task field when evt_mgmt.avoid_int_enabled is set to true (expected behavior) Issue Secondary alerts in an automated alert group do not have an incident attached, and the Task field on those alerts remains empty. The primary alert of the same group has an incident populated as expected. Symptoms Some alerts in the instance show an incident reference in the Task field; others remain empty.Alerts without a populated Task field are consistently secondary alerts within an automated alert group.The primary alert in the same group does have an incident attached.The Alert Management Rule and the base Event Management subflows (such as ITOM - Open Incident V2) run to completion and log as Completed.No errors are recorded in the alert, incident, or flow execution logs. Cause This is intentional, expected behavior rather than a defect or misconfiguration. The system property evt_mgmt.avoid_int_enabled (introduced in the Orlando release) controls whether secondary alerts inside an automated alert group create their own incidents. When the property is set to true, the base Event Management subflows are designed to: Allow the primary alert of a group to create or link to an incident as normal.Skip incident creation for secondary alerts in the same group.Leave the Task field on secondary alerts empty by design — they remain associated with the issue through the alert-group relationship and the primary alert, rather than through a direct incident link. The property exists to reduce incident noise so a single underlying issue produces one incident for the group, rather than one incident per correlated alert. Resolution No fix is required because the observed behavior matches design intent. Select the option that fits the noise versus visibility preference for your environment. Option A — Keep current behavior (preferred when reducing incident noise is the priority): Leave evt_mgmt.avoid_int_enabled set to true.Use the primary alert's incident as the single point of action for the whole group.Treat secondary alerts as supporting evidence. They remain visible and linked through the alert group but will not show a value in the Task field. Option B — Have secondary alerts also create or link to incidents: Navigate to sys_properties.list and locate evt_mgmt.avoid_int_enabled.Set the value to false and save the record.Be aware that this change is global. Every secondary alert in every group will follow the standard Alert Management Rule subflow path and create or attach an incident. Incident volume will increase, sometimes significantly. Test this change in a non-production instance before applying it in production. Verification: Property = true → Task remains empty on secondary alerts (expected).Property = false → Task is populated with an incident reference. Keywords secondary alerts, primary alert, automated alert group, alert correlation, alert aggregation, Task field empty, alert without incident, evt_mgmt.avoid_int_enabled, Event Management subflows, ITOM Open Incident V2, incident noise reduction, Alert Management Rule References ServiceNow product documentation — Event Management subflows in the base system: https://www.servicenow.com/docs/ (navigate to the current family release → IT Operations Management → Event Management → Subflows provided in the base system)KB0755140 — Avoid incidents for secondary alerts (related article on the property's introduction)