---
title: Experimental alerting system glossary
description: Definitions of key terms used throughout the experimental Kibana alerting system documentation.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6521/explore-analyze/alerting/kibana-alerting-experimental/glossary
products:
  - Elastic Cloud Serverless
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Planned
---

# Experimental alerting system glossary
These terms appear throughout the experimental alerting system docs. If a term is unclear while reading, check its definition here before going further.
<definitions>
  <definition term="Action policy">
    A configuration that controls whether and how often an alert episode triggers a notification, including which alerts qualify and how to avoid sending too many notifications. A single action policy can apply to one rule, several rules, or all rules in the space.
  </definition>
  <definition term="Alert episode">
    The complete record of one problem tracked in Alert mode, from first detection to recovery, moving through states (pending, active, recovering, inactive).
  </definition>
  <definition term="Breach">
    A single instance when a rule's query finds a match, which may or may not open an alert episode depending on how the rule is configured.
  </definition>
  <definition term="Dispatcher">
    The background process that evaluates action policies against active alert episodes on a short interval (around 5 seconds), independent of the rule schedule.
  </definition>
  <definition term="ES|QL">
    The query language every rule uses to search your data. To learn more, refer to the [ES|QL reference](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql).
  </definition>
  <definition term="Notification">
    The message or action delivered when an alert episode matches an action policy and a workflow sends it, such as a Slack message, an email, or a webhook call.
  </definition>
  <definition term="Rule">
    The definition of what to watch for in your data, how often to check, and what counts as a match; runs on a schedule and produces signals (Signal mode) or tracks alert episodes (Alert mode).
  </definition>
  <definition term="Rule event">
    A record written to `.rule-events` every time a rule runs and its query finds a match; in Signal mode it is a signal, in Alert mode it belongs to an alert episode.
  </definition>
  <definition term="Severity">
    A label attached to alert episodes to indicate urgency; available as a filter in action policies so critical episodes can be routed differently from low-priority ones.
  </definition>
  <definition term="Signal">
    A rule event recorded in Signal mode; stored and queryable in Discover but doesn't open an alert episode or trigger notifications.
  </definition>
  <definition term="Threshold">
    The condition a rule uses to decide when something is worth alerting on, including how many times the condition must be met before an alert episode opens or closes.
  </definition>
  <definition term="Workflow">
    The automation that sends a message or runs an action when an action policy decides a notification should go out, such as posting to Slack, sending an email, or calling a webhook.
  </definition>
</definitions>