Experimental alerting system glossary

These terms appear throughout the experimental alerting system docs. If a term is unclear while reading, check its definition here before going further.

Action policy: A configuration that controls which alert episodes invoke a workflow and how often. A single action policy can apply to one rule, several rules, or all rules in the space. To learn more, refer to Notifications and actions.
Alert episode: The complete record of one problem, from first detection to recovery, moving through states (pending, active, recovering, inactive). An alert episode is the grouping of rule events that share episode.id. To learn more, refer to Alerts.
Breach: A matching row from a rule run. Kibana writes it as a rule event. Whether that event belongs to an alert episode depends on the rule's configuration. To learn more, refer to ES|QL query.
Dispatcher: The background process that evaluates action policies against eligible alert episodes on a short interval (around 5 seconds), independent of the rule schedule. To learn more, refer to Reduce notification noise.
ES|QL: The language the system uses to evaluate your data. Some creation paths generate the query for you. To learn more, refer to the ES|QL reference.
Notification: The message or action a workflow sends (such as a Slack message, an email, or a webhook call) when an alert episode matches an action policy or a lifecycle trigger fires. To learn more, refer to How action policies are evaluated.
Rule: The definition of what to watch for in your data, how often to check, and what counts as a match. A rule runs on a schedule. Kibana writes rule events when the query finds a match. The rule's configuration determines whether those events belong to alert episodes. To learn more, refer to Rules.
Rule event: A record Kibana writes to .rule-events when a rule finds a match: one event per matching row, per run. Kibana never overwrites these events. Events with type: alert carry episode.* fields and belong to an alert episode. Events with type: signal stay in .rule-events for later analysis. To learn more, refer to Rule events.
Severity: A label stored on rule events when the query emits a recognized value. Action policies use it only for alert episodes, so critical alert episodes can be routed differently from low-priority ones. To learn more, refer to Configure rule severity.
Signal: A rule event with type: signal. These events stay in .rule-events. They don't appear on Alerts and aren't evaluated by action policies or lifecycle triggers. To learn more, refer to Query rule events and Rule mode.
Threshold: The condition a rule uses to decide when something is worth alerting on, including how many times the condition must be met before an alert episode opens or closes. To learn more, refer to Alert delay and Recovery condition.
Workflow: The automation that sends a message or runs an action (such as posting to Slack, sending an email, or calling a webhook) when an action policy or an alert episode lifecycle trigger invokes it. To learn more, refer to Connect workflows.