In Kingston, on alert form, there is a "Create Incident" button, which is based on Alert Action Rule and Task Template.

In London, the button is relabelled as "Quick Incident", and it's no longer based on Alert Action Rule / Task Template.

(Alert Action Rule is deprecated in London, and replaced by Alert Management Rule)




Option 1

Use the "Quick Response" button, and the "Create Task (legacy)" action.

The "Create Task (legacy)" action is configured in the Alert Management Rule.

Please refer to: Create alert management rules


Option 2

Use script include: EvtMgmtCustomIncidentPopulator to customize fields.


Option 3

(Not recommended as this is going back to legacy methods)

Change below system property to true:

Then check if the em_alert_rule record is active.

If the rule is already migrated, it's set to inactive. In this case disable the alert management rule (em_alert_management_rule) that's created from this alert action rule, then use background script to set it to active.



Additional Information

Create alert management rules

Article Information

Last Updated:2019-08-02 20:48:44