--- title: Example: Binding alerts to non-host CIs description: Bind alerts to an application service \(a non-host CI\) using event rules and event field mapping. This example demonstrates how to achieve this by leveraging the IP address associated with the service. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/event-management/t\_EMBindServiceCI.html release: australia product: Event Management classification: event-management topic_type: task last_updated: "2026-03-12" reading_time_minutes: 4 breadcrumb: [Overriding default binding, Binding alerts to CIs, Event rules, Processing Events, Configure, Event Management, ITOM AIOps, IT Operations Management] --- # Example: Binding alerts to non-host CIs Bind alerts to an application service \(a non-host CI\) using event rules and event field mapping. This example demonstrates how to achieve this by leveraging the IP address associated with the service. ## Before you begin Role required: evt\_mgmt\_admin ## About this task When an event is generated, it may not always include the exact name of the Application Service it affects. Instead, it might provide details such as an IP address. In this example, suppose application services are identified by IP addresses. Since the goal is to bind the alert to an Application Service, you need to determine which service name corresponds to the given IP address. To achieve this, follow these steps: 1. Match the correct Application Service: Override the default binding and select **Binding Type** as **CI field matching**. The binding process needs to associate the alert with an Application Service, not a host. In the event rule, set the **CI Type** to **Application Service** so that the system searches for the service in the Application Service table \(cmdb\_ci\_service\_auto\). 2. Extract the IP address from the event description: The event might contain a message like `Service is down. IP address is: 196.1.1.24`. You need to extract the IP address from this description for further processing. \[Omitted image "em-example-event-msg.png"\] Alt text: Extract IP address from the Description field. 3. Translate the IP address into a service name using Event Field Mapping: Use Event Field Mapping to look up the extracted IP address in the CMDB and find the associated application service. Once a matching service is found, its name is stored in the **Name** field of the event. 4. Bind the alert to the correct Application Service: If the service name is identified, the alert's CI is populated with that service. ## Procedure 1. Navigate to **All** > **Event Management** > **All Events**. 2. Open the specific event for which you want to create an event rule. 3. Select **Create Event Rule**. The new event rule page opens. Some fields in the event rule are populated based on the event record data, such as the Source field value. 4. In the **Event Rule Info** tab, in the **Name** field, enter `application service binding`. 5. Select the **Binding** tab. In this tab, you select the CI type as a service \(non-host\) instead of a host. The goal is to bind alerts to an Application Service, not to a physical or virtual machine. 6. Perform the following steps: 1. Select the **Override default binding** check box. 2. In the **Binding type** field, select **CI field matching**. 3. From the **CI type** list, select **Application Service**. \[Omitted image "em-example-binding-ci-type.png"\] Alt text: In the Binding tab, the CI type is selected as Application Service. 7. Select the **Transform and Compose Alert Output** tab. In this tab, you extract the IP address of the application service into a manually created field. Extracting the IP allows the system to look up the corresponding service in the Application Service table \(cmdb\_ci\_service\_auto\). Without extracting the IP, the system wouldn’t be able to determine which Application Service the event belongs to, making it difficult to bind the alert correctly. 8. Perform the following steps: 1. Clear the **Node** field. When an event is processed, it often comes with multiple fields of information. The **Node** field typically contains the host or device name. However, the goal is to bind the alert to an Application Service rather than a host. Clearing the **Node** field ensures that the system focuses on identifying the correct service instead of mistakenly associating the alert with a host CI. \[Omitted image "em-example-clear-node.png"\] Alt text: Clear the Node field. 2. Under **Event Input** > **Event Raw Info**, select **Description**. The Edit Regex Expressions window opens. 3. In the Mark Expressions section, select the IP address, manually enter a field name \(e.g., service\_ip\_address\), and press Enter to save it. \[Omitted image "em-example-regex-field.png"\] Alt text: A field is created manually to store the IP address. 4. Select **Done**. The IP address is extracted into the newly created **service\_ip\_address** field, which is added to the **Additional info** field of the alert. This allows it to be used later to identify the corresponding Application Service. 9. Select **Submit** in the event rule to save your changes. 10. Navigate to **All** > **Event Management** > **Rules** > **Event Field Mapping**. In Event Field Mapping, configure the extracted IP address to map it to the corresponding service name. The event provides only an IP address, but alerts need to be associated with a service name \(not just an IP\). The system needs to map this IP to its corresponding Application Service so that teams can easily identify the impacted service. 11. Select **New**. The Event Field Mapping window opens. 12. Perform the following: \[Omitted image "em-example-event-field-mapping.png"\] Alt text: Configure the extracted IP address to map it to the corresponding service name.
Field Action
Name Enter the name of the mapping.Example: mapping from ip\_address to service name.
Source Enter `AWS`.**Note:** The source is the same as the one in the Events record.
Mapping type Select **Map field and transform value \(Single field\)**
Source field Enter `service_ip_address`.
Target field Enter `name`.The target field value is the column name in the Application Service table \(cmdb\_ci\_service\_auto\) where the source field value is searched.
Transform value pairs
From value 196.1.1.24
To value Corp E-mail
13. Select **Submit**. The system extracts the IP address of the service from the event and stores it in the **service\_ip\_address** field. Since the Application Service table \(cmdb\_ci\_service\_auto\) does not have a column for searching by IP address, the Transform value pairs feature maps the IP address to a name. In this case, it maps to Corp E-mail and saves it in the **name** field within the **Additional info** field of the alert. The **Target field** specifies where to search for the Corp E-mail in the Application Service table. The system looks for Corp E-mail in the **name** column of the Application Service table \(cmdb\_ci\_service\_auto\). If a match is found, the alert is bound to the corresponding Application Service. \[Omitted image "em-example-result.png"\] Alt text: Binds alerts to service.