---
title: Triage alert episodes in the experimental alerting system
description: Take triage actions on alert episodes in the experimental alerting system. Acknowledge, snooze, resolve, activate, deactivate, tag, and assign alert episodes individually or in bulk.
url: https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/alerting/experimental-alerting-system/alerts/triage-alert-episodes
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Experimental since 9.5
---

# Triage alert episodes in the experimental alerting system
From the **Alerts** page (find **Alerting V2 Preview** in the navigation menu or [global search](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/find-and-organize/find-apps-and-objects), then go to **Alerts**), you can take the following triage actions on alert episodes individually or in bulk. For deeper investigation of a specific alert episode, refer to [Investigate alert episodes](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/alerting/experimental-alerting-system/alerts/investigate-alert-episodes).

## Track review status

Mark an alert episode as seen, or flag it again for follow-up, without changing its lifecycle state.

| Action        | Description                                     | When to use                                                                                            | Scope   |
|---------------|-------------------------------------------------|--------------------------------------------------------------------------------------------------------|---------|
| Acknowledge   | Marks the alert episode as seen.                | You've reviewed the alert episode and want to track that it's been seen without taking further action. | Episode |
| Unacknowledge | Removes the seen marker from the alert episode. | You want to re-flag an alert episode for follow-up.                                                    | Episode |


## Silence notifications

Temporarily silence notifications for an alert episode's series, without disabling the rule.

| Action   | Description                                                                                                                                                         | When to use                                                                                                                                                           | Scope  |
|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
| Snooze   | Silences notifications for the alert episode's series for a set duration. The rule continues to evaluate and the alert episode remains visible.                     | A known condition is expected to persist for a fixed time and you want to reduce noise without disabling the rule, for example during a scheduled maintenance window. | Series |
| Unsnooze | Ends the active snooze, restoring notifications immediately. Clears the snooze for all alert episodes sharing the same `group_hash`, not only the one you acted on. | The condition has changed and you want notifications to resume before the snooze expires.                                                                             | Series |

Snooze is one of several silencing mechanisms in the experimental alerting system, each with a different scope. For the full comparison, refer to [Reduce notification noise](https://www.elastic.co/elastic/docs-builder/docs/4075/explore-analyze/alerting/experimental-alerting-system/action-policies/reduce-notification-noise).

## Close and reopen alert episodes

Close an alert episode once the underlying problem is fixed, or reopen it if it turns out the problem wasn't resolved.

| Action    | Description                       | When to use                                                             | Scope  |
|-----------|-----------------------------------|-------------------------------------------------------------------------|--------|
| Resolve   | Closes the alert episode.         | The underlying problem is fixed and the alert episode should be closed. | Series |
| Unresolve | Reopens a resolved alert episode. | The problem has recurred or was closed prematurely.                     | Series |


## Override the automatic lifecycle

Take manual control of an alert episode's lifecycle state.

| Action     | Description                                                                                          | When to use                                                                                    | Scope   |
|------------|------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|---------|
| Activate   | Manually moves the alert episode to `active` state without waiting to meet the activation threshold. | Another signal already confirms the problem, or the metric recovered but the problem persists. | Episode |
| Deactivate | Returns a manually activated alert episode to normal behavior.                                       | You want to restore automatic recovery behavior for a previously activated alert episode.      | Episode |

<note>
  **Activate** ignores automatic recoveries once triggered. The alert episode stays open until you manually close it with Resolve or Deactivate.**Deactivate** resumes automatic recovery detection. The alert episode can close on its own the next time the rule evaluates as recovered, but deactivating alone doesn't close the current alert episode.
</note>


## Organize and assign alert episodes

Add context to an alert episode for filtering, routing, or ownership.

| Action        | Description                                   | When to use                                                                           | Scope   |
|---------------|-----------------------------------------------|---------------------------------------------------------------------------------------|---------|
| Edit tags     | Adds or removes tags on the alert episode.    | You want to categorize alert episodes for routing, filtering, or reporting.           | Series  |
| Edit assignee | Assigns the alert episode to a specific user. | You want to establish clear ownership during investigation or prevent duplicate work. | Episode |


## Investigate the underlying data

Go to Discover to inspect the data behind an alert episode.

| Action           | Description                                                                                       | When to use                                                                                                     | Scope   |
|------------------|---------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|---------|
| Open in Discover | Opens the rule's base ES|QL query scoped to the time window around when the alert episode opened. | You want to verify what data the rule was evaluating or investigate whether the condition is a genuine problem. | Episode |