Event Management
About 10% of the CIS-SM exam — see all 6 domains.
Service Mapping and Event Management are complementary ITOM capabilities; the exam tests the seam between them.
Why they pair
Event Management ingests events from monitoring tools, deduplicates and correlates them into alerts, and then uses the dependency relationships built by Service Mapping to calculate service impact. Without a map, an alert is just a host problem; with a map, the platform can say which application service is degraded and how the fault propagates upward.
Impact and service health
- Alerts are bound to CIs; impact flows up the dependency tree that Service Mapping created, so a database alert can show as impacting the application service that depends on it.
- You can view active alerts directly on the application service map, seeing which CIs are affected and how relationships carry the impact.
- Event Management can show cross-service impact — how a child service's degradation affects a parent service.
- Service health dashboards summarize the operational state of services using this combined data.
Self-health
Event Management includes a self-health application service map so operators can confirm Event Management's own components are healthy.
Fast-recall — Domain 4
- Event Management correlates events → alerts; Service Mapping's relationships turn alerts into service impact.
- Impact propagates up the dependency tree; view active alerts on the application service map.
- Supports cross-service (child→parent) impact and service health views.
- A self-health application service map monitors Event Management itself.
Sample questions from this domain
Three of the 30 in this domain, with the reasoning. The full set is in the question bank.
What is the primary input that Event Management processes?
- A. Credentials
- B. Service maps
- C. Discovery schedules
- D. Events from monitoring tools, which are normalized and may become alerts ✓
Why: Event Management ingests events from monitoring tools, normalizes them, and can generate alerts. Service maps, credentials, and discovery schedules are not the event inputs.
What is the difference between an event and an alert in Event Management?
- A. They are the same
- B. An alert is raw; an event is processed
- C. An event is a raw notification; an alert is a deduplicated, actionable record created from one or more events ✓
- D. Events are only manual
Why: An event is a raw notification, while an alert is the deduplicated, actionable record derived from events. They are not identical, the roles are not reversed, and events are not only manual.
How does Service Mapping enhance Event Management?
- A. By storing events as credentials
- B. By providing service context so alerts can be tied to the business/application services they impact ✓
- C. By deleting alerts
- D. By disabling discovery
Why: Service Mapping supplies service context, enabling alerts to be associated with the services they impact for prioritization. It does not delete alerts, store events as credentials, or disable discovery.