Executive Summary
Give every shortlisted tool a week of your own alerts and ask which incidents it would have opened, and why.
IT operations management (ITOM) tools find what runs in your estate, collect the alerts your monitoring tools raise, group related alerts into incidents, and run the fix or route it to a person. HPE defines IT operations management (ITOM) as the practice of managing the day-to-day operation, performance, availability, and reliability of an organization's IT infrastructure and digital services, using processes and tools to discover, provision, monitor, maintain, and support resources across on-premises, cloud, hybrid, and edge environments.
Choose ITOM vendors on five things: how the tool discovers infrastructure and keeps service maps current; how it correlates events from the monitoring tools you keep; whether it sits on your IT service management (ITSM) platform or beside it; what it automates, and under which approvals; and what its price meter counts.
The vendors divide by the product they started from: an operations module on a service management platform, an operations suite with its own discovery and CMDB, infrastructure monitoring with automation, service analytics on a log data platform, an observability platform that correlates events, and a correlation layer that sits above every monitoring tool. Test discovery and alert intake first, because correlation depends on both.
What Is IT Operations Management (ITOM)?
HPE defines IT operations management (ITOM) as the practice of managing the day-to-day operation, performance, availability, and reliability of an organization's IT infrastructure and digital services, using processes and tools to discover, provision, monitor, maintain, and support resources across on-premises, cloud, hybrid, and edge environments. ITOM software covers that work: discovery and inventory, monitoring, event management, and the automation that restores a service.
The part most buyers are replacing is event handling. HPE describes monitoring, event management, and incident response as collecting and correlating alerts and events, identifying issues that affect services, prioritizing them by impact, and coordinating remediation to restore normal operations quickly. A tool that only forwards every alert adds to the noise it was bought to reduce.
ITOM and ITSM are bought together but do different jobs. HPE states that ITSM manages how IT services are designed and delivered to end users, focusing on service desks and ticketing, while ITOM manages the underlying hardware, networks, and software infrastructure required to keep those services running. In practice, ITOM opens, enriches and closes the incidents that ITSM tracks, so the link between the two products matters as much as either one.
Discovery feeds both. It records each configuration item and how items depend on one another, which is what lets a tool say which service an alert affects. NIST defines it as an aggregation of information system components that is designated for configuration management and treated as a single entity in the configuration management process.
ITOM, observability and AIOps overlap, and vendors use the terms loosely. HPE describes ITOM as the established discipline, observability as the modern data-gathering philosophy that feeds it, and AIOps as the intelligent engine that powers it. This guide covers the operations layer. Telemetry collection and APM are compared in the APM and observability guide, and correlation-only products in the AIOps guide.
Searches for “IT operations management services” usually mean a provider that runs operations for you. This guide covers the software. A managed service provider will run one of these platforms, or its own, so ask which one, who owns its configuration, and what you keep when the contract ends.
How Do ITOM Tools Turn Alerts Into Incidents?
In three steps: collect alerts and change events from every monitoring tool into one place, remove duplicates, then group the alerts that share a cause into one incident with the affected service attached. Tools differ in what they group on: rules you write, the service map, time, or a model trained on your history.
Start from what an operator should be woken for. Google SRE describes teams sending page-worthy alerts to their on-call rotation and important but subcritical alerts to their ticket queues, with all other alerts retained as informational data for status dashboards. Google SRE states that at the scale its systems operate, being alerted for single-machine failures is unacceptable because the data is too noisy to be actionable, and that a large system should be designed to aggregate signals and prune outliers. Google SRE states that with SLOs that are meaningful, understood and represented in metrics, alerting can be configured to notify an on-caller only when there are actionable, specific threats to the error budget.
Rule-based correlation is explicit and editable. BigPanda states that correlation patterns set rules to define relationships between system elements, which are used to dynamically cluster alerts into incidents. BigPanda documentation states that BigPanda can correlate a maximum of 300 alerts into a single incident. BigPanda documentation states that administrators are able to adjust correlation patterns to fit the needs of the organization. Datadog documentation states that Event Correlation groups events based on their relationships or on user-defined configurations to reduce the number of notifications and issues.
Topology-based correlation uses the service map. Dynatrace states that Dynatrace Intelligence causal AI root cause analysis automatically evaluates all captured and ingested information and highlights entities within the causal topology identified as the root cause of a complex situation. Splunk states that Event iQ applies AIOps-driven event correlation, topology, and fuzzy matching to group related alerts into episodes. OpenText states that its AI-driven correlation cuts event volume by 30-95% and identifies the probable cause with a confidence score and traceable reasoning.
Correlation is only as good as the context attached to each alert. BigPanda states that it enhances incident context by ingesting and normalizing data from diverse sources, including topology, configuration management database (CMDB), and change data. Datadog states that it can automatically enrich ingested events or alerts with business-specific data from a configuration management database (CMDB) or an operational spreadsheet. Check how a tool behaves when the CMDB is wrong or a configuration item is missing, because the alert still has to reach someone.
Noise-reduction figures in vendor material come from other customers’ estates. Replay your own alert history instead, and count the incidents the tool opens, the ones it merged that should have stayed apart, and the ones it split that should have been one.
| Correlation method | How it groups alerts | Where it fails | Ask the vendor |
|---|---|---|---|
| Deduplication | Repeats of the same alert become one | Different alerts from the same fault stay separate | Which fields define a duplicate |
| Rules and patterns | Alerts sharing tags, source and a time window become one incident | Rules go stale as the estate changes | Who maintains the rules, and how a change is tested |
| Topology | Alerts on dependent items in the service map become one incident | Gaps or errors in discovery and the CMDB | What happens to an alert on an item the map does not hold |
| Causal analysis | Dependencies and anomalies are evaluated to name one root cause | Telemetry the platform does not collect itself | Which data sources the analysis uses |
| Learned models | Patterns in past alerts and incidents suggest groupings | New services with no history | How a suggestion is explained and approved |
What Should an ITOM Platform Do?
Four jobs: discover, correlate, route and automate. Most products do all four. They differ in which one they were built around, and the others are often thinner.
Discovery builds the inventory and the service map. ServiceNow states that it gives agentless insight into infrastructure and applications on premises, in the cloud, or in containerized environments. BMC Helix states that its automated, agentless discovery continuously scans and maps assets. ServiceNow states that it generates service maps with machine learning using tag-based, top-down, and traffic-based methods. Ask how often the map refreshes, and what the tool does with an item that disappears.
Discovery can also come from a separate product that feeds whichever CMDB you run. OpenText describes OpenText Universal Discovery and CMDB as vendor-neutral IT discovery and enterprise CMDB software that works with existing IT tools and ITSM platforms. BMC Helix states that discovery data can be synced for ITSM-related impact analysis, incident management, and change management.
Correlation must take alerts from tools you will not replace. ServiceNow states that it correlates events into alerts and that rule changes can be tested to preview behavior before production deployment. Splunk states that ITSI works across Cisco and third-party monitoring tools without ripping and replacing existing investments. Dynatrace states that OpenPipeline ingests and normalizes data from cloud platforms, CI/CD systems, log sources, and third-party observability tools.
Routing puts the incident in front of the right team with its context. Datadog states that it can automatically create tickets in ITSM tools such as ServiceNow and Jira, with bi-directional syncing. ServiceNow states that its ITOM federates signals from systems, services, and applications for service mapping and integrates natively with ITSM.
Automation runs the fix. BMC Helix describes executing remediations using pre-approved automations, policy-driven workflows, or self-healing actions. OpenText states that it executes predefined remediation tasks under policy guardrails, role-based access, approvals, and a full audit trail. Ask which actions run without a person, who approves the rest, and where each action is logged.
| Capability | What to test | Why it matters |
|---|---|---|
| Discovery | Agentless and agent-based coverage of your cloud, data center, network and container estate | Correlation by service needs an accurate inventory |
| Service mapping | How maps are built (traffic, tags, top-down) and how fast they update after a change | Stale maps send incidents to the wrong team |
| Event ingestion | Connectors for every monitoring tool you keep, plus change events | A tool that cannot see an alert cannot group it |
| Correlation | Rules, topology and models on a replay of your own alerts | Decides how many incidents your team handles |
| Root cause | Whether the suggested cause matches post-incident reviews you already have | A wrong cause costs more time than no cause |
| ITSM link | Two-way incident sync with your ITSM tool and CMDB | Keeps one record of each incident |
| Automation | Runbooks, approvals, role-based access and an audit trail | Decides what can run without a person |
| Deployment | SaaS, on premises or air-gapped, and where data is stored | Regulated estates may rule out SaaS-only tools |
Vendors in IT Operations Management (ITOM) Tools
Representative vendors include BigPanda, BMC Helix Operations Management, Datadog, Dynatrace, OpenText Operations Bridge (AI Operations Management), ScienceLogic, ServiceNow ITOM and Splunk ITSI / Cisco. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
Each vendor below is placed by the product it started from. That starting point decides where the incident record lives and which data the correlation uses.
Operations modules on a service management platform keep discovery, events and incidents in one system. ServiceNow states that ITOM keeps the CMDB accurate by mapping infrastructure, while service mapping links components to build dynamic service maps for impact and root-cause analysis. BMC Helix states that it intelligently correlates and clusters noisy alerts across tools into a single, actionable incident, preserving service context and impact. BMC announced on October 9, 2024 the decision to create two stand-alone, independent companies, BMC and BMC Helix. BMC stated that BMC Helix is the company encompassing the Digital Service and Operations Management (DSOM) business.
The operations suite brings its own discovery, CMDB and correlation. OpenText lists OpenText AI Operations Management (Operations Bridge) as enterprise event and performance management software. OpenText describes OpenText AI Operations Management as an AIOps platform that correlates its own and third-party observability data against a living service model of apps, infrastructure, and network, available as SaaS, hybrid, or on premise with an air-gapped AI deployment option.
Infrastructure monitoring with automation starts from device and network coverage. ScienceLogic states that Skylar One empowers enterprises to connect fragmented data silos and discover and contextualize infrastructure across complex environments. ScienceLogic states that the ScienceLogic AI Platform can be deployed on premises, in the cloud, across hybrid environments, or as ScienceLogic SaaS.
Service analytics on a data platform builds service health from data already in that platform. Splunk describes Splunk IT Service Intelligence as an AIOps and service intelligence solution that brings together data from applications, infrastructure, networks, and existing monitoring tools to monitor service health, reduce alert noise, and find likely root cause. Splunk states that ITSI connects service health, KPIs, and dependencies to business priorities, with health scores and real-time dashboards to prioritize work by customer, revenue, and operational impact. Cisco announced on March 18, 2024 that it had completed the acquisition of Splunk.
Observability platforms correlate on the telemetry they collect, and some also take alerts from other tools. Dynatrace states that its AIOps is powered by Dynatrace Intelligence for AI-driven analysis, Smartscape for real-time topology mapping, Grail for unified data storage, and OpenPipeline for ingesting and normalizing data. Dynatrace states that when a new containerized process starts in Kubernetes, OneAgent detects it, maps its dependencies in Smartscape, and begins monitoring it immediately. Datadog states that Event Management can be used without purchasing any other Datadog products. The APM and observability guide compares both on data collection and pricing.
The independent correlation layer sits above every monitoring tool and in front of the ITSM tool. BigPanda states that its platform supports both on-premises and cloud-based workloads and integrates with popular monitoring and observability tools.
| Vendor | Approach | Where it fits |
|---|---|---|
| BigPanda | Independent correlation layer | Correlation patterns across monitoring tools, enriched with topology, CMDB and change data |
| ScienceLogic | Infrastructure monitoring with automation | Skylar One discovery and monitoring across hybrid estates, metered by node |
| Datadog | Observability platform with event correlation | Event Management that correlates Datadog and third-party alerts, priced per event evaluated by a correlation pattern |
| Dynatrace | Observability platform with event correlation | Causal root cause analysis on OneAgent telemetry and the Smartscape topology |
| BMC Helix Operations Management | Operations module on a service management platform | Alert correlation and governed remediation, with agentless BMC Helix Discovery |
| ServiceNow ITOM | Operations module on a service management platform | Discovery, service mapping and event management feeding the ServiceNow CMDB and ITSM |
| OpenText Operations Bridge (AI Operations Management) | Operations suite with discovery and CMDB | Event and performance management with Universal Discovery and CMDB; SaaS, hybrid or on premises |
| Splunk ITSI / Cisco | Service analytics on a data platform | Service health scores and alert episodes on data in Splunk |
Eight vendors across six approaches. The approaches were defined first, and each vendor was then selected and placed by the product it started from; ServiceNow and BMC Helix share one approach, as do Dynatrace and Datadog. The eight vendors from the previous edition stay. Placement in this table cannot be bought. The roster check for this edition covered 12 vendors, including LogicMonitor, HPE OpsRamp, PagerDuty and Moogsoft, and any of them can describe its own product in the Spotlight below.
How Are ITOM Tools Priced?
By different meters: managed nodes or devices, discovered configuration items, correlated events, hosts and data volume, or a platform subscription. Ask each vendor to price the same estate: devices and cloud resources discovered, alerts per month from each monitoring tool, and the people who will use the console.
Datadog's pricing page lists event correlation starting at $0.10 per event evaluated by a correlation pattern, billed annually, or $0.14 on demand, with Datadog generated events free. ScienceLogic states that usage of Skylar One and Skylar Compliance is measured by the number of nodes or managed devices monitored by the software. ScienceLogic states that average daily usage is assessed periodically and that overages above the license scope purchased are invoiced in arrears at an agreed rate.
Packaging decides what a quote covers. ServiceNow states that Discovery is available with IT Operations Management. Check whether discovery, service mapping, event management and automation are in the quoted edition or sold separately, and whether the platform license is a prerequisite.
Event-based and node-based meters grow differently. An event meter grows with alert volume, so a noisy tool added later raises the bill. A node meter grows with the estate, including short-lived containers. Ask how each counts duplicates, test environments and bursts.
| Meter | You pay for | Grows with | Where it goes wrong |
|---|---|---|---|
| Managed node or device | Each server, device or resource monitored | Estate size | Short-lived containers and cloud resources counted as nodes |
| Configuration item | Each item discovered or managed in the CMDB | Discovery scope | Discovery turned up without a plan for what to keep |
| Correlated event | Each event evaluated by a correlation rule | Alert volume | A noisy new monitoring tool doubles the bill |
| Host or data volume | Hosts monitored and telemetry ingested | Telemetry | Logs and metrics kept longer than anyone reads them |
| Platform subscription | An edition of the platform, often with user counts | Modules and users | Discovery or event management sold as an add-on |
How Do You Roll Out an ITOM Platform?
Start with discovery and two or three critical services. Correlation and automation depend on the inventory and the service map, so they come second. The phases below assume a pilot of about three months.
Run discovery on the pilot services, reconcile it with the CMDB, and fix the gaps. Map the services end to end and record who owns each one.
Connect the monitoring tools that cover the pilot services. Replay a month of past alerts, compare the incidents the tool would have opened with the ones your team handled, and tune rules before switching on live routing.
Send correlated incidents to the ITSM tool with service, owner and change context. Confirm that updates and closures sync both ways.
Automate the fixes your team already runs by hand, with approvals for anything that changes production. Add services one group at a time, and retire monitoring consoles nobody reads.
What should you ask vendors about IT Operations Management (ITOM) Tools?
Put these questions in the RFP, and ask for each answer to be shown on your own data.
-
Do incidents, changes and the CMDB already live on one service management platform?Yes Include that platform’s operations module, and test its correlation against an independent layer on the same alert replay.No Weight connectors to your ITSM tool and CMDB as heavily as correlation.
-
Will you keep more than three monitoring tools?Yes Shortlist products that take and correlate third-party alerts, and price them on your alert volume.No Compare the correlation built into the observability or monitoring platform you are standardizing on.
-
Must the platform run on premises or without internet access?Yes Ask for the deployment options in writing, including where AI features run.No Compare SaaS regions, data retention and the cost of connecting on-premises collectors.