--- title: Experimental alerting system glossary description: Definitions of key terms used throughout the experimental Kibana alerting system documentation. url: https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/glossary products: - Elastic Cloud Serverless - Kibana applies_to: - Elastic Cloud Serverless: Experimental - Elastic Stack: Experimental since 9.5 --- # Experimental alerting system glossary These terms appear throughout the experimental alerting system docs. If a term is unclear while reading, check its definition here before going further. A configuration that controls which alert episodes invoke a workflow and how often. A single action policy can apply to one rule, several rules, or all rules in the space. To learn more, refer to [Notifications and actions](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/notifications-actions). The complete record of one problem, from first detection to recovery, moving through states (pending, active, recovering, inactive). An alert episode is the grouping of [rule events](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference) that share `episode.id`. To learn more, refer to [Alerts](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts). A matching row from a rule run. Kibana writes it as a [rule event](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference). Whether that event belongs to an alert episode depends on the rule's configuration. To learn more, refer to [ES|QL query](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-query). The background process that evaluates action policies against eligible alert episodes on a short interval (around 5 seconds), independent of the rule schedule. To learn more, refer to [Reduce notification noise](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/action-policies/reduce-notification-noise). The language the system uses to evaluate your data. Some creation paths generate the query for you. To learn more, refer to the [ES|QL reference](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4116/reference/query-languages/esql). The message or action a workflow sends (such as a Slack message, an email, or a webhook call) when an alert episode matches an action policy or a lifecycle trigger fires. To learn more, refer to [How action policies are evaluated](/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/action-policies/about-action-policies#how-action-policies-evaluated). The definition of what to watch for in your data, how often to check, and what counts as a match. A rule runs on a schedule. Kibana writes rule events when the query finds a match. The rule's configuration determines whether those events belong to alert episodes. To learn more, refer to [Rules](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules). A record Kibana writes to `.rule-events` when a rule finds a match: one event per matching row, per run. Kibana never overwrites these events. Events with `type: alert` carry `episode.*` fields and belong to an [alert episode](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts). Events with `type: signal` stay in `.rule-events` for later analysis. To learn more, refer to [Rule events](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference). A label stored on rule events when the query emits a recognized value. Action policies use it only for alert episodes, so critical alert episodes can be routed differently from low-priority ones. To learn more, refer to [Configure rule severity](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-severity). A [rule event](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference) with `type: signal`. These events stay in `.rule-events`. They don't appear on **Alerts** and aren't evaluated by action policies or lifecycle triggers. To learn more, refer to [Query rule events](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts/query-signals) and [Rule mode](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-mode). The condition a rule uses to decide when something is worth alerting on, including how many times the condition must be met before an alert episode opens or closes. To learn more, refer to [Alert delay](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-alert-delay) and [Recovery condition](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-recovery). The automation that sends a message or runs an action (such as posting to Slack, sending an email, or calling a webhook) when an action policy or an alert episode lifecycle trigger invokes it. To learn more, refer to [Connect workflows](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/workflows-alerting).