---
title: Connect workflows to the experimental alerting system
description: How workflows connect to the experimental alerting system through action policies and alert episode lifecycle triggers, and when to use each.
url: https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/workflows-alerting
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Experimental since 9.5
---

# Connect workflows to the experimental alerting system
[Workflows](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/workflows) are the delivery layer that defines what happens when the experimental alerting system takes an action, such as sending a message, calling a webhook, or triggering an automation. Workflows connect the alerting system to your incident-response tools.
This page covers how action policies drive workflow invocations at runtime, the available alert episode lifecycle triggers, and when to use each pathway.

## How the alerting system connects to workflows

The experimental alerting system connects to workflows through two pathways. Both require an alert episode.
- **Action Policies** - Action policies evaluate eligible alert episodes on a continuous schedule and invoke workflows based on match conditions and frequency settings.
- **Alert episode lifecycle triggers** - Workflows are invoked when a specific event occurs on an alert episode, such as when the alert episode is activated, assigned, or deactivated.


### Action policies

Action policies evaluate alert episodes on a continuous schedule and invoke workflows when an alert episode meets the configured conditions. After a rule runs, the system routes each alert episode through episode eligibility, match conditions, and frequency gates before invoking a workflow. For the step-by-step evaluation sequence, refer to [How action policies are evaluated](/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/action-policies/about-action-policies#how-action-policies-evaluated).

### Alert episode lifecycle triggers

Lifecycle triggers are a type of [event-driven trigger](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/workflows/triggers/event-driven-triggers) that start a workflow immediately when a specific event occurs on an alert episode, with no scheduling or gating.
When an alert episode is [activated](/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts#alert-episode-lifecycle), or [assigned, acknowledged, or snoozed](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts/triage-alert-episodes), the experimental alerting system emits a named trigger event (such as `alerting.episodeAssigned` or `alerting.episodeAcked`) and any workflow attached to it runs immediately.

### When to use action policies or lifecycle triggers

If you're unsure whether to use lifecycle triggers or action policies, the following table compares when each option is a good fit. Both can run different workflows simultaneously and coexist without conflict.

|                       | Action policies                                                                      | Lifecycle triggers                                                                                                          |
|-----------------------|--------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| **How they run**      | Evaluate alert episodes on a continuous schedule                                     | React immediately to a specific event                                                                                       |
| **Frequency control** | Apply eligibility, match condition, and frequency gates                              | Fire exactly once per event, no gates to configure                                                                          |
| **Best for**          | Recurring notifications and escalation logic that runs as long as a problem persists | One-shot automations, such as opening a ticket when an alert episode is assigned or posting a message when it's deactivated |


## Related pages

- [Create and configure an action policy](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/action-policies/create-configure-action-policy): Start routing alert episodes to workflows.
- [About action policies](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/action-policies/about-action-policies): Understand how action policies gate alert episodes before invoking a workflow.