Triage alert episodes in the experimental alerting system

From the Alerts page (find Alerting V2 Preview in the navigation menu or global search, then go to Alerts), you can take the following triage actions on alert episodes individually or in bulk. For deeper investigation of a specific alert episode, refer to Investigate alert episodes.

Mark an alert episode as seen, or flag it again for follow-up, without changing its lifecycle state.

Action Description When to use Scope
Acknowledge Marks the alert episode as seen. You've reviewed the alert episode and want to track that it's been seen without taking further action. Episode
Unacknowledge Removes the seen marker from the alert episode. You want to re-flag an alert episode for follow-up. Episode

Temporarily silence notifications for an alert episode's series, without disabling the rule.

Action Description When to use Scope
Snooze Silences notifications for the alert episode's series for a set duration. The rule continues to evaluate and the alert episode remains visible. A known condition is expected to persist for a fixed time and you want to reduce noise without disabling the rule, for example during a scheduled maintenance window. Series
Unsnooze Ends the active snooze, restoring notifications immediately. Clears the snooze for all alert episodes sharing the same group_hash, not only the one you acted on. The condition has changed and you want notifications to resume before the snooze expires. Series

Snooze is one of several silencing mechanisms in the experimental alerting system, each with a different scope. For the full comparison, refer to Reduce notification noise.

Close an alert episode once the underlying problem is fixed, or reopen it if it turns out the problem wasn't resolved.

Action Description When to use Scope
Resolve Closes the alert episode. The underlying problem is fixed and the alert episode should be closed. Series
Unresolve Reopens a resolved alert episode. The problem has recurred or was closed prematurely. Series

Take manual control of an alert episode's lifecycle state.

Action Description When to use Scope
Activate Manually moves the alert episode to active state without waiting to meet the activation threshold. Another signal already confirms the problem, or the metric recovered but the problem persists. Episode
Deactivate Returns a manually activated alert episode to normal behavior. You want to restore automatic recovery behavior for a previously activated alert episode. Episode
Note

Activate ignores automatic recoveries once triggered. The alert episode stays open until you manually close it with Resolve or Deactivate.

Deactivate resumes automatic recovery detection. The alert episode can close on its own the next time the rule evaluates as recovered, but deactivating alone doesn't close the current alert episode.

Add context to an alert episode for filtering, routing, or ownership.

Action Description When to use Scope
Edit tags Adds or removes tags on the alert episode. You want to categorize alert episodes for routing, filtering, or reporting. Series
Edit assignee Assigns the alert episode to a specific user. You want to establish clear ownership during investigation or prevent duplicate work. Episode

Go to Discover to inspect the data behind an alert episode.

Action Description When to use Scope
Open in Discover Opens the rule's base ES|QL query scoped to the time window around when the alert episode opened. You want to verify what data the rule was evaluating or investigate whether the condition is a genuine problem. Episode