﻿---
title: Share, alert, and automate
description: Use Kibana to share reports, set up alerts to detect important changes, automate responses with workflows, and track incidents with cases.

url: https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/share-alert-and-automate
products:
  - Elastic Cloud Serverless
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Share, alert, and automate
The Elasticsearch platform provides tools to share insights, get notified about important changes, automate responses, and track incidents. These tools work together across every Elastic solution and project type.

## Distribute insights with reporting and sharing

[Reporting and sharing](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/report-and-share) lets you export and distribute dashboards, Discover sessions, and visualizations, including to people who don't log into Kibana.
- Generate reports on demand or [schedule them automatically](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/report-and-share/automating-report-generation)
- Export as PDF, PNG snapshots, or CSV files
- Share direct links to live dashboards with real-time, filtered views

[Learn more about reporting and sharing →](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/report-and-share)

## Get notified when it matters with alerting

[Alerting](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/alerting) monitors your Elasticsearch data continuously and notifies you when specific conditions are met, so you don't have to watch dashboards around the clock.
![Creating a threshold alert rule in Kibana](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/images/kibana-create-threshold-alert-created.png)

Define rules that evaluate your data on a schedule and trigger actions when criteria are met:
- **Threshold rules**: notify you when error rates spike
- **Machine learning rules**: alert on anomalies
- **Geo-containment rules**: track assets leaving a defined area

Notifications go where your team already works: email, Slack, PagerDuty, Microsoft Teams, webhooks, and more.
Elastic solutions extend this foundation with domain-specific rules. Security detection rules match threat patterns, while Observability rules monitor SLOs, infrastructure metrics, and log error rates. All rules share the same interface, action framework, and notification channels.
[Learn more about alerting →](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/alerting)

## Automate multi-step responses with workflows

[Workflows](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/workflows) turn manual, repetitive processes into automated sequences that run reliably every time.
![The workflow editor showing a sequence of automated steps](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/images/workflows-editor.png)

A workflow is a sequence of steps triggered by an alert, a schedule, or a manual action. Each step can:
- Query Elasticsearch or call external APIs
- Branch on conditions or loop over collections
- Create cases, send notifications, or isolate hosts

For example, when a security alert fires, a workflow can enrich it with threat intelligence, create a case, notify the on-call analyst, and isolate the affected host, all without human intervention.
[Learn more about workflows →](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/workflows)

## Track and coordinate response with cases

[Cases](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/cases) provide a central place to track incidents, document findings, and coordinate response efforts across your team.
![Creating a case in Kibana](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/images/kibana-cases-create.png)

- Attach alerts, files, and visualizations to build a record of your investigation
- Assign team members and add comments
- Push updates to external systems like Jira or ServiceNow

Cases are available in Elastic Security, Observability, and Stack Management.
[Learn more about cases →](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/cases)

## How these tools work together

These capabilities chain together into complete operational workflows:
1. A **dashboard** reveals a pattern, such as error rates climbing for a specific service.
2. An **alert rule** detects the threshold breach and triggers a notification.
3. A **workflow** automatically enriches the alert, checks if the service is in a maintenance window, and creates a case if it isn't.
4. A **case** tracks the investigation, collecting related alerts, team comments, and resolution steps.
5. A **scheduled report** captures the post-incident dashboard state and distributes it to stakeholders.

Together, these tools close the loop from data to action to resolution without requiring you to leave the Elastic platform.

## Next steps

- **[Automatically generate reports](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/report-and-share/automating-report-generation)**: Set up recurring report delivery for your dashboards.
- **[Getting started with alerting](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/alerting/alerts/alerting-getting-started)**: Create your first alert rule and configure notification channels.
- **[Get started with workflows](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/workflows/get-started)**: Build your first automated workflow to respond to alerts.
- **[Create a case](https://www.elastic.co/elastic/docs-builder/docs/2927/explore-analyze/cases/create-cases)**: Start tracking an incident and attach relevant alerts and evidence.