---
title: Configure a rule in the experimental alerting system
description: Overview of all configurable rule settings in the experimental alerting system. Required settings are mode, ES|QL query, and schedule. Optional settings include severity, grouping, activation and recovery thresholds, no-data handling, and tags.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/configure-a-rule
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Planned
---

# Configure a rule in the experimental alerting system
Rules in the experimental alerting system have three required settings and several optional ones. Start with the required settings in order. Only add optional settings once the detection logic is validated. The following table links to a dedicated page for each setting with field descriptions, accepted values, and guidance on when to configure it.

| Setting                                                                                                                                                                                        | Description                                                                                                 | Required |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|----------|
| [Rule mode](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-mode)                                | Can be Signal or Alert. Controls whether matching rows generate signal documents or tracked alert episodes. | Required |
| [ES|QL query](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-query)                             | The detection logic and the parameters available in query expressions.                                      | Required |
| [Schedule and lookback](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-schedule)                | How often the rule evaluates and how far back the query looks.                                              | Required |
| [Severity](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-severity)                             | Assign severity levels to alert episodes using a `severity` column in query output.                         | Optional |
| [Grouping](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-grouping)                             | Track multiple subjects (hosts, services, users) as independent alert series in one rule.                   | Optional |
| [Activation and recovery thresholds](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-thresholds) | Reduce noise with delay modes for opening and closing alert episodes. Alert mode only.                      | Optional |
| [No-data handling](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/configure-no-data-handling)                  | What the rule records when the base query returns no results.                                               | Optional |
| [Tags and runbooks](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-tags)                        | Free-form labels and investigation guides attached to the rule. Alert mode only.                            | Optional |