You need to create a Network Event Source that defines which entries in the Event table constitute a single process. For example, which external events are all part of the same incident.
Typically, an Event from the same third party application for the same CI would correspond to a single process: for example, if your network management system logged an event for Server_01, and then logged another incident for Server_01, then these two events would be considered to be a part of the same Incident.
To configure a Network Event Source:
Select the Event Manager node at the top of the Event Manager Configuration tree, then in the Actions list, click Create Network Source. The Event Source dialog appears.
In the Event Source Name box, type the name that you want to use to identify it by.
In the Module list, select the required module.
For example, Incident Management.
In the Process list, select the process that you want to associate with the Event Source.
Optionally, in the Template list, select the process template that you want to associate with the Event Source.
For information about designing processes and templates, see the Designer Guide.
In the Event Identification list, select the attributes that will define an instance of a process. Typically, this will be Event Source and Configuration Item.
When you want to activate this Event Source, select the Enable this Event Source check box, then click OK. A new branch for the Network source is added to the Configuration tree in Event Manager with the icon . All events must have a Create Process event definition, so one of these is also created beneath the new Network source branch.
You can modify and delete Network sources from the Configuration tree using the appropriate actions from the Actions list. However, after you have created a Network source, you cannot change the process that is associated with it, because this could invalidate any attribute mappings that had previously been configured.