--- title: Triage alerts in Kibana Universal Alerting description: Take triage actions on alerts. Acknowledge, snooze, resolve, reopen, tag, and assign alerts individually or in bulk. url: https://www.elastic.co/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/alerts/triage-alert-episodes products: - Elastic Documentation - Kibana applies_to: - Serverless Observability projects: Generally available - Elastic Stack: Planned --- # Triage alerts in Kibana Universal Alerting Use the **Alerts** page in Universal Alerting to triage alerts individually or in bulk. You can mark alerts as seen, silence their notifications, close or reopen them, and tag or assign them. To open the page, go to **Alerting** → **Alerts** in the Observability navigation menu, or find **Alerts** using the [global search field](https://www.elastic.co/elastic/docs-builder/docs/4843/explore-analyze/find-and-organize/find-apps-and-objects). For deeper investigation of a specific alert, refer to [Investigate alerts](https://www.elastic.co/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/alerts/investigate-alert-episodes). ## Track review status Mark an alert as seen, or flag it again for follow-up, without changing its lifecycle state. | Action | Description | Scope | |---------------|------------------------------------------------------|-------| | Acknowledge | Marks the alert as seen and stops its notifications. | Alert | | Unacknowledge | Removes the seen marker and restores notifications. | Alert | ## Silence notifications Temporarily silence notifications for an alert's series, without disabling the rule. | Action | Description | Scope | |----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------| | Snooze | Silences notifications for the alert's series for a set duration, for example during a scheduled maintenance window. The rule continues to evaluate and the alert remains visible. | Series | | Unsnooze | Ends the active snooze and restores notifications immediately. Clears the snooze for all alerts sharing the same `group_hash`, not only the one you acted on. | Series | Snooze is one of several silencing mechanisms in Universal Alerting, each with a different scope. For the full comparison, refer to [Reduce notification noise](https://www.elastic.co/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/action-policies/reduce-notification-noise). ## Close and reopen alerts Close an alert once the underlying problem is fixed, or reopen it if it turns out the problem wasn't resolved. | Action | Description | Scope | |-----------|----------------------------------------------------------------------------------------------------------------------------------------|-------| | Resolve | Closes the alert immediately, without waiting for the rule to detect recovery. | Alert | | Unresolve | Reopens an inactive alert as active, for example when the problem recurs. It continues as the same alert instead of opening a new one. | Alert | After you resolve an alert, its notifications stop and the rule doesn't reopen it. If the rule's condition still matches on its next run, a new alert starts for the series. The new alert follows the normal lifecycle, and action policies can send notifications for it. An alert you unresolve stays active on every rule run, even when the rule detects recovery. It closes only when you resolve it again. ## Organize and assign alerts Add context to an alert for filtering, routing, or ownership. | Action | Description | Scope | |-----------------|----------------------------------------------------------------------------------|-------| | Edit alert tags | Adds or removes tags on the alert. | Alert | | Edit assignee | Assigns the alert to a specific user, so others know who owns the investigation. | Alert | ## Investigate the underlying data Go to Discover to check whether the data behind an alert shows a genuine problem. | Action | Description | Scope | |------------------|-------------------------------------------------------------------------------------------|-------| | Open in Discover | Opens the rule's base ES|QL query scoped to the time window around when the alert opened. | Alert | ## Triage a flapping alert Base your response to a flapping alert on the data behind it, not on its status. A flapping alert keeps changing between `active` and `recovering`, so its status can't tell you whether the problem is ongoing or fixed. To recognize a flapping alert, refer to [Spot a flapping alert](/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/alerts/investigate-alert-episodes#flapping). The following steps are for alerts from Universal Alerting rules. On alerts from Classic Alerting rules, acknowledging an alert doesn't stop its notifications. For other differences, refer to [How actions affect alerts from Classic Alerting](#classic-triage-action-results). To triage a flapping alert: 1. [Acknowledge the alert](#track-review-status) to stop its notifications while you investigate, because flapping doesn't stop or delay them. The acknowledgment stays in place each time the alert returns to `active`, because it's still the same alert. 2. Check the data behind the alert. If the alert has a [trend chart](/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/alerts/investigate-alert-episodes#assess-metric-behavior), use it to compare the metric to the rule's threshold. To see the [values that the rule's query most recently returned](/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/alerts/investigate-alert-episodes#inspect-data), open the alert's **Data container** tab. To see the source documents, select **Open in Discover**. 3. Respond based on what the data shows: - If the data shows a real problem each time the alert returns to `active`, the problem is recurring. For example, a metric clearly crosses the rule's threshold each time. Treat the alert like any other active alert, and investigate the cause. When the alert's status changes to `recovering`, don't resolve the alert until the data confirms the fix. - If the data shows normal activity when the alert is `active`, the rule is too sensitive. For example, a metric hovers around the rule's threshold instead of clearly crossing it. Leave the alert acknowledged instead of resolving it. If you resolve it, a new alert starts the next time the rule's condition matches, and action policies might send notifications for it. To stop the rule's alerts from flapping, update the rule's condition, or add a [custom recovery condition](/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/rules/configure-rule-recovery#recovery-strategy-when-to-use) to the rule. If you can't edit the rule, ask someone who can. ## Triage alerts from Kibana Classic Alerting To act on alerts with **Classic** in the **Source** column, your role needs [privileges in both alerting systems](/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/manage/configure-access#alerting-classic-alert-privileges). ### How actions affect alerts from Classic Alerting You can't unresolve or assign Classic Alerting alerts, or open them in Discover. The other actions use the matching Classic Alerting feature, so some results differ from the same action on a Universal Alerting alert: | Action | What happens to a Classic Alerting alert | |----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Acknowledge, Unacknowledge | Adds or removes the [acknowledged](/elastic/docs-builder/docs/4843/explore-analyze/alerting/alerts/view-alerts#acknowledge-alerts) marker. Unlike a Universal Alerting alert, the alert keeps sending notifications. | | Snooze, Unsnooze | [Snoozes](/elastic/docs-builder/docs/4843/explore-analyze/alerting/alerts/view-alerts#snooze-alerts) or unsnoozes this alert only. Other alerts from the same rule keep sending notifications. A snooze lasts until the time you set. If you select **Indefinitely**, the snooze lasts until you unsnooze the alert. For **Condition based** snooze, use the Classic Alerting alerts pages. | | Resolve | Marks the alert as [untracked](/elastic/docs-builder/docs/4843/explore-analyze/alerting/alerts/view-alerts#alert-status). Its status changes to **Inactive**, its notifications stop, and its status no longer updates. You can't undo this. | | Edit alert tags | Adds or removes tags on the alert. | ### Add alerts from Classic Alerting to a case To add a Classic Alerting alert from an Observability rule to a case, turn on the [**Classic Alerting: Show Classic Alerts table**](/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/setup#alerting-setup-v1-alerts-page) advanced setting in the space, then add the alert from the **Alerts (Classic)** page. Serverless Observability projects: Generally available You can't add Classic Alerting alerts to cases from the **Alerts** page.