Experimental alerting system glossary

These terms appear throughout the experimental alerting system docs. If a term is unclear while reading, check its definition here before going further.

Action policy: A configuration that controls whether and how often an alert episode triggers a notification, including which alerts qualify and how to avoid sending too many notifications. A single action policy can apply to one rule, several rules, or all rules in the space.
Alert episode: The complete record of one problem tracked in Alert mode, from first detection to recovery, moving through states (pending, active, recovering, inactive).
Breach: A single instance when a rule's query finds a match, which may or may not open an alert episode depending on how the rule is configured.
Dispatcher: The background process that evaluates action policies against active alert episodes on a short interval (around 5 seconds), independent of the rule schedule.
ES|QL: The query language every rule uses to search your data. To learn more, refer to the ES|QL reference.
Notification: The message or action delivered when an alert episode matches an action policy and a workflow sends it, such as a Slack message, an email, or a webhook call.
Rule: The definition of what to watch for in your data, how often to check, and what counts as a match; runs on a schedule and produces signals (Signal mode) or tracks alert episodes (Alert mode).
Rule event: A record written to .rule-events every time a rule runs and its query finds a match; in Signal mode it is a signal, in Alert mode it belongs to an alert episode.
Severity: A label attached to alert episodes to indicate urgency; available as a filter in action policies so critical episodes can be routed differently from low-priority ones.
Signal: A rule event recorded in Signal mode; stored and queryable in Discover but doesn't open an alert episode or trigger notifications.
Threshold: The condition a rule uses to decide when something is worth alerting on, including how many times the condition must be met before an alert episode opens or closes.
Workflow: The automation that sends a message or runs an action when an action policy decides a notification should go out, such as posting to Slack, sending an email, or calling a webhook.