Connect workflows to the experimental alerting system

Workflows are part of the experimental alerting system in Kibana. They are the delivery layer that defines what happens when the experimental alerting system takes an action, such as sending a message, calling a webhook, or triggering an automation. Workflows are what allow your team's incident response tools to connect with the experimental alerting system.

This page covers how action policies drive workflow invocations at runtime, the available alert episode lifecycle triggers, and when to use each pathway.

The experimental alerting system connects to workflows through two pathways.

• Action policies - Action policies evaluate active alert episodes on a continuous schedule and invoke workflows based on match conditions and frequency settings.
• Alert episode lifecycle triggers - Workflows are invoked when a specific state change occurs on an alert episode, such as when the alert episode is activated, assigned, or resolved.

Action policies evaluate alert episodes on a continuous schedule and invoke workflows when an episode meets the configured conditions. After a rule runs, the system routes alert episodes to workflows through a suppression check, match conditions, grouping, and frequency gates. For the full step-by-step evaluation sequence, refer to How action policies are evaluated.

Lifecycle triggers start a workflow immediately in response to a specific state change on an alert episode, without any scheduling or gating. Alert episode lifecycle triggers are a type of event-driven trigger that start a workflow automatically when a specific event occurs.

The experimental alerting system emits a trigger event each time an alert episode changes state (for example, when it's activated, assigned to a user, acknowledged, or snoozed) and any workflow attached to that trigger type runs immediately in response.

For a list of available triggers and event payload fields, refer to Alert episode lifecycle triggers.

If you're unsure whether to use lifecycle triggers or action policies, the following table compares when each option is a good fit. Both can run different workflows simultaneously and coexist without conflict.

• Create and configure an action policy to start routing alert episodes to workflows.
• About action policies to learn how action policies evaluate and gate alert episodes before invoking a workflow.