---
title: Rules in the experimental alerting system
description: Rules in the experimental alerting system define what to detect using ES|QL. Each match is written as a rule event. The rule's configuration determines whether those events are grouped into an alert episode.
url: https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Experimental since 9.5
---

# Rules in the experimental alerting system
A rule is where the experimental alerting system starts. It points Kibana at the data you care about, describes what counts as a problem in ES|QL, and says how often to check. On each scheduled run, Kibana writes each matching row as a [rule event](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference) to `.rule-events`. Those events are never overwritten. Alert episodes (and any notifications) come from events that are grouped into an alert episode.
Use this page to understand what a rule does, why notifications are sent by workflows on action policies rather than on the rule, and to find the right path to create, configure, or manage a rule.

## Workflows on action policies send notifications

Rules define *what* to detect. Action policies match alert episodes from any rule and decide whether and when to invoke a workflow. The workflow sends the notification.
This separation means you can update how alert episodes are routed to workflows without touching a rule, and have multiple action policies respond to the same rule independently.

## Create, configure, and manage rules

Use these pages to create a rule, change its settings, or manage existing rules.
- [Create a rule](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/create-a-rule): Compare creation paths and choose the one that fits your workflow.
- [Configure a rule](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/configure-a-rule): Set the schedule, grouping, alert delay, recovery condition, and no-data behavior.
- [Rule mode](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-mode): Set whether matches are grouped into an alert episode or remain available for later analysis.
- [View and manage rules](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/view-manage-rules): Enable, disable, clone, delete, and bulk-manage rules from the **Rules** page.

<important>
  Because the experimental alerting system is still evolving, its UI can change before general availability. Rather than pointing to an exact button or menu, the documentation focuses on the underlying concepts and behavior. If something doesn't match what you see in the Kibana UI, look for the closest equivalent instead. The concepts and behaviors described in the documentation still apply.
</important>