Understand the certification
ServiceNow CIS-EM（Event Management）验证在 ServiceNow ITOM 套件中实施事件管理模块的能力。60 题 / 90 分钟，及格线 70%（42 题），费用 $250 USD，需先持有 CSA。
Event Management 的核心功能是将第三方监控工具产生的海量事件集中到 ServiceNow，通过规则引擎过滤、分类、关联 CMDB CI，最终生成有意义的告警（Alert）并自动创建 ITSM Incident。事件处理流水线是考试最重要的知识点：原始事件（Event）→ Event Rule 过滤和字段映射 → Alert Rule 判断 → Alert 创建 → CI 关联 → Alert 聚合（Grouping）→ Incident 创建。
和 ITSM 的 Incident Management 的区别：ITSM 的 Incident 是人工报告的故障（"我的电脑上不了网"），EM 的 Alert 是监控系统自动发现的异常（"服务器 CPU 使用率 > 95% 持续 5 分钟"），EM 可以自动将 Alert 升级为 ITSM Incident。
Exam at a glance
- Exam code
- CIS-EM
- Provider
- 其他
- Format
- Single choice / Multiple select
- Language
- English
- Validity
- 3 years
- Exam fee
- $250
Skills in focus
Learning outcomes
- Earn the ServiceNow CIS-EM certification
- Implement event ingestion pipelines and translate raw events into actionable alerts
- Configure event and alert rules to reduce noise while preserving signal quality
- Bind alerts to CIs correctly and support operational response workflows
- Improve your fit for ITOM monitoring and Event Management implementation roles
Who this is for
- ServiceNow consultants implementing Event Management and ITOM monitoring workflows
- Operations engineers responsible for alert quality and monitoring signal pipelines
- Platform administrators integrating monitoring tools with ServiceNow
- ITOM specialists working on event-to-alert automation and triage
Before you start
- CSA is recommended before taking CIS-EM
- Hands-on experience with Event Management or ITOM monitoring integrations
- Understanding of events, alerts, CI relationships, and operational triage
- Familiarity with connectors, field mapping, and event ingestion flows
- Basic CMDB and Discovery knowledge is useful because of CI binding
Your learning path
3 chapters
Plan your preparation
- Learning hours
- 20h
- With relevant experience
- 5-7 weeks
- Starting from scratch
- 10-12 weeks
- Daily study
- 1.5-2h
Included in your preparation
- Focused coverage of Event Rules versus Alert Rules and where each is applied
- Practical work on connectors, event transformations, CI binding, and deduplication
- Scenario-driven questions on noise reduction, aggregation, and operational monitoring
- Clear linkage between Event Management, CMDB, Discovery, and Incident workflows
- Mock exam aligned to the official 60-question, 90-minute format
1. 第一阶段：事件处理流水线（2-3 周）
在 PDI 上手动创建 Event 记录，观察 Event Rule 的匹配和处理。理解 Event Rule 的评估顺序（按 Order 字段），Stop Processing 标志的作用。配置 Alert Rule 将 Event 转换为 Alert，设置 Alert Severity（Critical/Major/Minor/Warning/Info）。Alert State Flow（Open → Acknowledged → Closing → Closed）。
2. 第二阶段：Connector + 凭据 + Transform Mapping（2-3 周）
配置 REST API Connector（最常用，接收 JSON 格式事件）。理解 MID Server 在 EM 中的角色（Connector 通过 MID Server 拉取外部监控数据）。Transform Map 将外部事件格式映射到 ServiceNow em_event 表字段。Flapping Detection（抖动检测，短时间内反复触发/恢复的告警合并处理）。
3. 第三阶段：AIOps + CMDB 关联 + 模考（2 周）
Alert Grouping（将同一 CI 或相关 CI 的多个 Alert 聚合为一组）。Alert 自动创建 ITSM Incident 的触发条件配置。Health Log Analytics（AIOps 功能，ML 分析日志异常）的概念。Operations Dashboard 的使用。Now Learning CIS-EM 路径 + 模考 2 次。
Career value
CIS-EM 在 ServiceNow ITOM 实施项目中是核心角色 — 大型企业（银行、电信）的运维团队同时使用多套监控工具（SolarWinds 监控网络、SCOM 监控 Windows、Nagios/Zabbix 监控 Linux），Event Management 将这些工具的告警统一收进 ServiceNow 实现单一告警平台。
在澳洲，CIS-EM 持证者的需求集中在 ServiceNow 合作伙伴的 ITOM Practice（Accenture、DXC、Fujitsu）。日薪合同制 $800-1100 AUD。
不适合的人群：做 ITSM 流程配置的 ServiceNow 顾问 — EM 需要理解监控系统的告警机制和网络协议（SNMP/REST API/Syslog）。没有 IT 运维/基础架构背景的人。
- 澳洲
- AUD 120,000 – 165,000
- 美国
- USD 110,000 – 155,000
- 中国
- CNY 280,000 – 450,000
Preparation tips
- 60 题 90 分钟，1.5 分钟/题。事件处理流水线的顺序题快速作答 — Event → Event Rule → Alert Rule → Alert → Incident。
- AIOps/ML 相关的题不多（2-3 道），只需理解概念（Alert Grouping/Health Log Analytics），不考具体配置。
- PDI 的 Event Management 功能可能需要额外激活插件（com.snc.itom.eventmgmt），确保在练习前已激活。
Common mistakes
- **Event Rule vs Alert Rule 混淆** — Event Rule 处理原始 Event（过滤噪声、映射字段），Alert Rule 处理过滤后的 Event（创建 Alert、关联 CI、设置 Severity）。两者是流水线关系，不是替代关系。
- **Connector 的 MID Server 绑定遗忘** — 大部分 Connector（REST API/JDBC/SNMP）需要通过 MID Server 访问外部监控系统。如果 MID Server 配置错误，Connector 无法拉取事件。
- **Alert Severity 不等于 Incident Priority** — Alert 的 Severity（Critical/Major/Minor）和自动创建的 Incident 的 Priority 通过映射规则关联，不是一对一的。需要理解 Alert-to-Incident 的映射配置。
Before you register
What is the CIS-EM exam format and passing criteria?
The CIS-EM exam contains 60 questions (multiple choice and multiple select) with a 90-minute time limit and a 70% passing score. The exam fee is $250 USD, scheduled through ServiceNow official channels. The certification is valid for 3 years and requires a Delta exam or recertification upon expiry.
What core knowledge domains does the CIS-EM exam cover?
The CIS-EM exam focuses on key Event Management areas: Event Processing Rules configuration, Alert Rules and alert management, Connector configuration and integration, Event Transform Mapping, Operational Visibility, and collaboration with other ITOM modules.
What is the difference between Event Rules and Alert Rules, and how does the exam test them?
Event Rules perform initial filtering and field mapping when events arrive, determining whether events require processing. Alert Rules convert processed events into Alerts and associate them with corresponding CIs. The exam tests rule execution order, condition configuration, field mapping logic, and how to set alert severity levels and grouping strategies.
What prerequisites and experience are recommended for the CIS-EM exam?
It is recommended to hold the ServiceNow CSA (Certified System Administrator) certification and have 6-12 months of hands-on experience configuring or managing the Event Management module. Familiarity with ITOM architecture, MID Server fundamentals, and integration with third-party monitoring tools (e.g., SolarWinds, Nagios, SCOM) is expected.
What are the key exam topics related to Connector configuration?
Connectors are core components for receiving external events in Event Management. The exam covers REST API connector, email connector, and JDBC connector configuration, as well as Connector Instance setup, authentication configuration, event field mapping, and connector testing and debugging methods.
How do the 116 practice questions help me prepare for the CIS-EM exam?
The practice questions cover all Event Management exam domains including event processing rules, alert management, connector configuration, transform mapping, and operational dashboards. Each question includes detailed explanations to help understand the complete event processing pipeline. The mock exam (60 questions/90 minutes) simulates the real exam experience.
Learner experiences
Loading reviews…
Event Rule 和 Alert Rule 的区别是考试第一大考点 — Event Rule 做初步过滤和字段映射（还在 Event 层），Alert Rule 决定是否创建 Alert 并关联 CI（升级到 Alert 层）。Connector 配置也出了 4-5 道，REST API Connector 和 Email Connector 的选型场景要理解清楚。
ITOM 顾问 4 ��
ServiceNow 合作伙伴 · 78% · 5 weeks
有运维背景理解 EM 概念很快（Event → Alert → Incident 的流程和传统 NOC 的工作方式一致），但 ServiceNow 平台的配置方式需要学习。Flapping Detection 考了 2 道，我之前没注意这个功能。
NOC Analyst 转 ServiceNow
运维 5 年 · 72% · 8 weeks
Start with the first chapter.
2 free chapters · Full preparation from $39