Universal Alerting
Universal Alerting is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered.
-
List action policies
- GET /api/alerting/v2/action_policies
-
Create an action policy
- POST /api/alerting/v2/action_policies
-
Delete action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_delete
-
Disable action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_disable
-
Enable action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_enable
-
Snooze action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_snooze
-
Cancel snooze for action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_unsnooze
-
Rotate API keys for action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_update_api_key
-
Delete an action policy
- DELETE /api/alerting/v2/action_policies/{id}
-
Get an action policy
- GET /api/alerting/v2/action_policies/{id}
-
Partially update an action policy.
- PATCH /api/alerting/v2/action_policies/{id}
-
Create or replace an action policy
- PUT /api/alerting/v2/action_policies/{id}
-
Disable an action policy
- POST /api/alerting/v2/action_policies/{id}/_disable
-
Enable an action policy
- POST /api/alerting/v2/action_policies/{id}/_enable
-
Snooze an action policy
- POST /api/alerting/v2/action_policies/{id}/_snooze
-
Unsnooze an action policy
- POST /api/alerting/v2/action_policies/{id}/_unsnooze
-
Update an action policy API key
- POST /api/alerting/v2/action_policies/{id}/_update_api_key
-
Bulk acknowledge alerts
- POST /api/alerting/v2/alerts/_bulk_ack
-
Bulk activate alerts
- POST /api/alerting/v2/alerts/_bulk_activate
-
Bulk assign alerts
- POST /api/alerting/v2/alerts/_bulk_assign
-
Bulk deactivate alerts
- POST /api/alerting/v2/alerts/_bulk_deactivate
-
Bulk tag alerts
- POST /api/alerting/v2/alerts/_bulk_tag
-
Bulk unacknowledge alerts
- POST /api/alerting/v2/alerts/_bulk_unack
-
Acknowledge an alert
- POST /api/alerting/v2/alerts/{id}/_ack
-
Activate an alert
- POST /api/alerting/v2/alerts/{id}/_activate
-
Assign an alert to a user
- POST /api/alerting/v2/alerts/{id}/_assign
-
Deactivate an alert
- POST /api/alerting/v2/alerts/{id}/_deactivate
-
Tag an alert
- POST /api/alerting/v2/alerts/{id}/_tag
-
Unacknowledge an alert
- POST /api/alerting/v2/alerts/{id}/_unack
-
List action policy executions
- GET /api/alerting/v2/execution_history/action_policies
-
List rule executions
- GET /api/alerting/v2/execution_history/rules
-
List rules
- GET /api/alerting/v2/rules
-
Create a rule
- POST /api/alerting/v2/rules
-
Create rules in bulk
- POST /api/alerting/v2/rules/_bulk_create
-
Delete rules in bulk by ID
- POST /api/alerting/v2/rules/_bulk_delete
-
Disable rules in bulk by ID
- POST /api/alerting/v2/rules/_bulk_disable
-
Enable rules in bulk by ID
- POST /api/alerting/v2/rules/_bulk_enable
-
Get rules in bulk
- POST /api/alerting/v2/rules/_bulk_get
-
Update the API key of rules in bulk by ID
- POST /api/alerting/v2/rules/_bulk_update_api_key
-
Delete rules matching a query (dry-run by default)
- POST /api/alerting/v2/rules/_delete_by_query
-
Disable rules matching a query (dry-run by default)
- POST /api/alerting/v2/rules/_disable_by_query
-
Enable rules matching a query (dry-run by default)
- POST /api/alerting/v2/rules/_enable_by_query
-
Update the API key of rules matching a query (dry-run by default)
- POST /api/alerting/v2/rules/_update_api_key_by_query
-
Delete a rule
- DELETE /api/alerting/v2/rules/{id}
-
Get a rule
- GET /api/alerting/v2/rules/{id}
-
Update a rule
- PATCH /api/alerting/v2/rules/{id}
-
Create or replace a rule
- PUT /api/alerting/v2/rules/{id}
-
Disable a rule
- POST /api/alerting/v2/rules/{id}/_disable
-
Enable a rule
- POST /api/alerting/v2/rules/{id}/_enable
-
Run a rule now
- POST /api/alerting/v2/rules/{id}/_run