At Altiris I wrote a report for myself to see all of the rules, whether they were Notification Rules, Routing Rules, Incident Rules or Automation Rules, that had been triggered on an incident and on what date.
Here is the code I used:
SELECT IDENTITY(INT) AS Number
FROM sysobjects s1
CROSS JOIN sysobjects s2
CREATE UNIQUE CLUSTERED INDEX Number_ind
SELECT top 1000 workitem_number, convert(char(10),workitem_modified_on,101) as 'Run',
CONVERT(int,SUBSTRING( workitem_rules_fired, Number,
CHARINDEX( ',', workitem_rules_fired + ',', Number ) - Number )) as Value
INNER JOIN Numbers
ON SUBSTRING( ',' + workitem_rules_fired, Number, 1 ) = ','
WHERE Number <= Len(workitem_rules_fired) + 1
AND workitem_number = %WorkNum%
--Get Rule Names...