View and manage Kibana alerting v2 rules

After a rule is created, edit its settings, pause it, remove it, and more from the page listing rules. The rules list gives you search, filter, sort, and bulk actions across all rules in the space. Selecting a rule name opens its details page, where you can review the full configuration and edit or act on it directly.

Select a rule name to open its details page. The details page shows:

• Conditions: The full ES|QL base query, alert condition, schedule, lookback, grouping, and recovery settings.
• Runbook: If the rule has an investigation guide, it appears here alongside Conditions.

Use Edit to modify the rule, or the actions menu to enable, disable, clone, or delete it.

Use Disable when you want the rule to stop running entirely until you re-enable it. This is different from snoozing, which suppresses notifications or quiets a series or policy without stopping rule evaluation.

• To snooze alert episodes or series, refer to View, manage, and reference alerts.
• To snooze or stop an action policy, refer to Manage action policies.