---
title: Experimental alerting system overview
description: The experimental Kibana alerting system uses ES|QL rules to detect conditions, track problems as alert episodes, and route notifications through reusable action policies.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6599/explore-analyze/alerting/system-overview
products:
  - Elastic Cloud Serverless
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Planned
---

# Experimental alerting system overview
The experimental alerting system in Kibana watches your Elasticsearch data continuously, so your team doesn't have to. You define the conditions that matter, such as when to open an issue, who should know, and how often to notify them. The system handles the rest.
<note>
  In the generally available Kibana alerting system, the term *alert* refers to a tracked occurrence of a rule condition. In the experimental alerting system, the equivalent concept is called an *alert episode*. The two terms describe similar ideas in different systems and are not interchangeable.
</note>


## The core idea

The experimental alerting system separates *detecting* a problem from *acting* on it:
- **Detecting** - Rules focus purely on what to watch for in your data and on collecting breach and recovery events.
- **Acting** - Action policies handle who gets notified, when, and how, independently of any rule.

You can build and test detection logic before wiring up any notifications, and update notification routing across all rules in one place without editing the rules themselves.

## The four building blocks

The experimental alerting system is built around four objects: rules, alert episodes, action policies, and workflows, each with a distinct role.

### Rules

A rule defines what to watch for in your data and how often to check. Every rule runs in one of two modes: alert or signal.
- **Alert** - Opens an alert episode when the rule finds a match and closes it when the condition clears, notifying your team at each episode state change. Helpful when you want to follow a problem from first detection to resolution.
- **Signal** - Records rule query results over time without opening episodes or sending notifications. Helps you build a baseline, spot trends, or collect evidence before deciding whether something is worth alerting on.


### Alert episodes

In Alert mode, the rule opens one alert episode per problem and keeps it open until the condition clears. The alert episode moves through states (pending, active, recovering, inactive) giving you one lifecycle to triage rather than a separate item per rule check.

### Action policies

An action policy is the gating layer between an alert episode and a workflow. It decides whether and when to invoke a workflow by evaluating episode eligibility, match conditions, and frequency. Policy configuration determines the scope. A policy can apply to alert episodes from a specific rule, multiple rules, or all rules in the space.

### Workflows

A workflow is what actually sends the message or runs the automation, for example, posting to Slack, sending an email, calling a webhook. The experimental alerting system invokes workflows through action policies that you configure to trigger on a schedule or on a state change on an alert episode.

## How the pieces fit together

At the simplest level:
1. A rule checks your data on a schedule.
2. The rule's query returns results when data matching its conditions is found.
3. The rule's mode determines what happens next:
   - Alert - The rule opens an alert episode to track the problem. An action policy can route it to a workflow to perform an action or send a notification.
- Signal - Each result is recorded for querying later. Nothing else happens.

For a more detailed explanation of each stage, refer to [How the experimental alerting system works](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6599/explore-analyze/alerting/experimental-alerting-system/how-it-works).

## Next steps

To understand how the experimental alerting system fits into Kibana's alerting options, refer to [Alerting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6599/explore-analyze/alerting) or [Compare alerting systems](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6599/explore-analyze/alerting/compare-alerting-systems).