About action policies

Action policies are part of the experimental alerting system in Kibana. An action policy is the gating layer between an alert episode and a workflow. It decides whether and when to invoke a workflow by running the alert episode through a sequence of gates. A workflow runs only if the alert episode clears each gate in sequence.

Action policies are independent of rules. A single action policy can cover alert episodes from many rules, so an action policy matching severity: "critical" applies regardless of which rule produced the alert episode. You can also update notification routing without touching any rule, and you can create rules without any action policy, which is useful for testing detection logic before wiring up notifications.

To scope an action policy to one rule, use a matcher expression, for example rule.id: "my-rule-id".

The three gates are episode eligibility, match conditions, and frequency:

• Episode eligibility - Skips episodes that are acknowledged, snoozed, or in a maintenance window. For details, refer to Reduce notification noise.
• Match conditions - Filters which alert episodes the action policy applies to. You define them using a KQL expression. An empty match condition applies to all eligible episodes in the space.
• Frequency - Controls how often the action policy can invoke its workflows for the same group of episodes, and how episodes batch before a workflow is invoked. If a workflow was already invoked within the frequency interval that you chose, the episode waits.<!-- For available options, refer to Action policy reference. -->

If any gate stops the episode, the workflow is not invoked for that action policy. Because each action policy evaluates alert episodes independently, an episode blocked by one action policy can still trigger a workflow through a second action policy with different conditions.

Every action policy you create has the potential to match alert episodes from any rule in the space. Which episodes actually get matched is expressed entirely through the KQL matcher. Leave the matcher empty to match all episodes in your space.

The following table shows how different KQL expressions control the matching scope of an action policy:

Multiple action policies can match the same alert episode, and each runs independently. There is no precedence or merging between them. If no action policy matches an alert episode, no workflow is invoked and no notification is sent. If you delete a rule, any action policies scoped to it are not deleted automatically. You must delete them manually after deleting the rule.

Kibana runs a background process called the dispatcher that checks for eligible alert episodes on a short interval (around 5 seconds) and evaluates action policies against them. The dispatcher runs on its own cycle, separate from the rule schedule.

For each enabled action policy that is not snoozed, the dispatcher works through the following steps:

• Create and configure an action policy: Set up match conditions, grouping, frequency, and workflow destinations.
• Manage action policies: Enable, disable, snooze, edit, or delete your action policies.
• Action policy reference: Look up match condition fields, grouping modes, and frequency options.