Triage alerts in Kibana Universal Alerting

Use the Alerts page in Universal Alerting to triage alerts individually or in bulk. You can mark alerts as seen, silence their notifications, close or reopen them, and tag or assign them. To open the page, go to Alerting → Alerts in the Observability navigation menu, or find Alerts using the global search field.

For deeper investigation of a specific alert, refer to Investigate alerts.

Mark an alert as seen, or flag it again for follow-up, without changing its lifecycle state.

Temporarily silence notifications for an alert's series, without disabling the rule.

Snooze is one of several silencing mechanisms in Universal Alerting, each with a different scope. For the full comparison, refer to Reduce notification noise.

Close an alert once the underlying problem is fixed, or reopen it if it turns out the problem wasn't resolved.

After you resolve an alert, its notifications stop and the rule doesn't reopen it. If the rule's condition still matches on its next run, a new alert starts for the series. The new alert follows the normal lifecycle, and action policies can send notifications for it.

An alert you unresolve stays active on every rule run, even when the rule detects recovery. It closes only when you resolve it again.

Add context to an alert for filtering, routing, or ownership.

Go to Discover to check whether the data behind an alert shows a genuine problem.

Base your response to a flapping alert on the data behind it, not on its status. A flapping alert keeps changing between active and recovering, so its status can't tell you whether the problem is ongoing or fixed. To recognize a flapping alert, refer to Spot a flapping alert.

The following steps are for alerts from Universal Alerting rules. On alerts from Classic Alerting rules, acknowledging an alert doesn't stop its notifications. For other differences, refer to How actions affect alerts from Classic Alerting.

To triage a flapping alert:

1. Acknowledge the alert to stop its notifications while you investigate, because flapping doesn't stop or delay them. The acknowledgment stays in place each time the alert returns to active, because it's still the same alert.

2. Check the data behind the alert. If the alert has a trend chart, use it to compare the metric to the rule's threshold. To see the values that the rule's query most recently returned, open the alert's Data container tab. To see the source documents, select Open in Discover.

3. Respond based on what the data shows:

   • If the data shows a real problem each time the alert returns to active, the problem is recurring. For example, a metric clearly crosses the rule's threshold each time. Treat the alert like any other active alert, and investigate the cause. When the alert's status changes to recovering, don't resolve the alert until the data confirms the fix.
   • If the data shows normal activity when the alert is active, the rule is too sensitive. For example, a metric hovers around the rule's threshold instead of clearly crossing it. Leave the alert acknowledged instead of resolving it. If you resolve it, a new alert starts the next time the rule's condition matches, and action policies might send notifications for it. To stop the rule's alerts from flapping, update the rule's condition, or add a custom recovery condition to the rule. If you can't edit the rule, ask someone who can.

To act on alerts with Classic in the Source column, your role needs privileges in both alerting systems.

You can't unresolve or assign Classic Alerting alerts, or open them in Discover. The other actions use the matching Classic Alerting feature, so some results differ from the same action on a Universal Alerting alert:

To add a Classic Alerting alert from an Observability rule to a case, turn on the Classic Alerting: Show Classic Alerts table advanced setting in the space, then add the alert from the Alerts (Classic) page.

You can't add Classic Alerting alerts to cases from the Alerts page.