alert-investigation

Investigate ITOM alerts using LEAP steps and ServiceNow data sources.

34|13|Updated Feb 6, 2026

Search Tags:#remediation #alerts #root-cause #knowledge-base #cmdb #itom #leap

Ready to run

npx skills add https://github.com/Happy-Technologies-LLC/happy-servicenow-skills --skill alert-investigation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: alert-investigation
Source: https://github.com/Happy-Technologies-LLC/happy-servicenow-skills/tree/main/skills/itom/alert-investigation
Command: npx skills add https://github.com/Happy-Technologies-LLC/happy-servicenow-skills --skill alert-investigation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill streamlines ITOM alert investigations by guiding users through a structured LEAP-based workflow to locate, examine, analyze, and propose remediation for alerts using ServiceNow data sources.

Core Features & Use Cases

LEAP Locate: identify the alert source, affected CI, and related context to establish a solid starting point.
Examine & Analyze: trace CI relationships, review recent changes, correlate with related alerts, and map business impact.
Propose Remediation: leverage knowledge base articles and historical resolutions to suggest actionable fixes and change actions.

Quick Start

Load the alert-investigation skill and run it against a specific EM alert to perform a LEAP-based investigation and generate remediation notes.

Frequently Asked Questions about alert-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate the root cause of ITOM alerts in ServiceNow?▼

ITOM alert root-cause investigation is performed using a LEAP-based workflow to locate, examine, analyze, and propose remediation by correlating data across em_alert, cmdb_ci, and change_request records.

What is the best way to find remediation suggestions for CMDB CI alerts?▼

Finding remediation suggestions for CMDB CI alerts involves analyzing knowledge base articles and historical resolutions, then mapping them to the impacted services and recent changes identified during the investigation.

Can I analyze clusters of related ITOM alerts instead of just a single alert?▼

Yes, alert investigation can be applied to a single alert or clusters of related alerts, allowing you to trace CI relationships, review recent changes, and correlate impacted services across the ITOM and CMDB ecosystems.

How does the LEAP workflow help with ServiceNow event management analysis?▼

The LEAP workflow helps with ServiceNow event management analysis by providing a structured process to locate the alert source, examine CI relationships, analyze recent changes, and propose auditable remediation actions.

Do I need CMDB data to perform an ITOM alert investigation?▼

Yes, CMDB data is required to perform an ITOM alert investigation, as the process extracts structured data from cmdb_ci tables to trace relationships, map business impact, and correlate changes with the alert.

What ServiceNow data sources are used for ITOM alert root-cause analysis?▼

ITOM alert root-cause analysis uses ServiceNow data sources including em_alert, em_event, cmdb_ci, change_request, and kb_knowledge to integrate multi-source data and generate auditable remediation suggestions.