Manage action policies for the experimental alerting system
Action policies are part of the experimental alerting system in Kibana. This page covers how to view action policy details, enable and disable action policies, snooze them during planned outages, and rotate their API keys. To monitor dispatcher activity and review execution outcomes, refer to Review action policy execution history.
From the Action policies list, you can open an action policy to see its full configuration, including match conditions, grouping mode, frequency, and destinations. The list also shows the display name of the user who created the action policy and the user who last updated it. You can also edit, clone, delete, enable, disable, snooze, or update its API key without leaving the list page.
You can disable an action policy so the dispatcher doesn't evaluate it for new alert episodes. You can snooze an action policy for a defined window so it doesn't dispatch notifications during that period. The dispatcher skips action policies that aren't enabled or are snoozed.
Snoozing an action policy differs from snoozing an alert episode. When you snooze an action policy, the dispatcher pauses and silences every alert series the action policy processes. When you snooze an alert episode, you target one specific series before action policy matching runs, silencing it regardless of which action policy handles it. Use alert snooze when you want to quiet a specific recurring alert without affecting other series handled by the same action policy.
During a maintenance window, action policies stop dispatching notifications automatically. You don't need to configure the action policy. Rule evaluation continues and alert episodes are still recorded in .rule-events. Configure Maintenance windows separately, not on the action policy.
You can rotate the API key used to run an action policy's workflows without changing matchers or destinations. Use the Update API key action on one action policy or for multiple selected action policies.
On the action policies list, select one or more action policies to enable, disable, snooze, and do more in bulk. Select all selects every action policy on the current page of results. Clear the selection before changing filters if you need a different set.
- Review action policy execution history: Check dispatcher outcomes and investigate unexpected notification behavior.
- Reduce notification noise: Silence individual alert episodes with acknowledgment, snooze, or deactivation.
- Action policy reference: Look up match condition fields, grouping modes, and frequency options.
- Create and configure an action policy: Set up or update the action policies you manage here.