Mainframe message alerts are created by sample event rules shipped with the Ironstream app which is installed on the ServiceNow instance. Message rules begin with 'EV390' and can be seen by going to Event Management > Rules > Event Rules and searching on “*EV390” in the Name column.