Configure a rule in the experimental alerting system
Rules in the experimental alerting system have three required settings and several optional ones. Start with the required settings in order. Only add optional settings once the detection logic is validated. The following table links to a dedicated page for each setting with field descriptions, accepted values, and guidance on when to configure it.
| Setting | Description | Required |
|---|---|---|
| Rule mode | Can be Signal or Alert. Controls whether matching rows generate signal documents or tracked alert episodes. | Required |
| ES|QL query | The detection logic and the parameters available in query expressions. | Required |
| Schedule and lookback | How often the rule evaluates and how far back the query looks. | Required |
| Severity | Assign severity levels to alert episodes using a severity column in query output. |
Optional |
| Grouping | Track multiple subjects (hosts, services, users) as independent alert series in one rule. | Optional |
| Activation and recovery thresholds | Reduce noise with delay modes for opening and closing alert episodes. Alert mode only. | Optional |
| No-data handling | What the rule records when the base query returns no results. | Optional |
| Tags and runbooks | Free-form labels and investigation guides attached to the rule. Alert mode only. | Optional |