Get started with the experimental alerting system
Use the following guides to get the experimental alerting system running in your space, set up role access for your team, and create your first rule.
- Set up the experimental alerting system: Review requirements, enable the
alerting:v2:enabledadvanced setting, and confirm the system is accessible in your space. - Configure access: Set up a role with the Kibana feature privileges needed to create rules, triage alerts, and query alert data.
- Create your first rule: A hands-on tutorial that walks you through loading sample data, creating a rule, and observing the alert lifecycle from breach through automatic recovery.
Once you're comfortable with the basics, use the following pages as your entry points into the rest of the experimental alerting system docs. They contain deeper explanations of core concepts, configuration guidance, and reference material for rules, alerts, and notifications.
- Rules shows you how to define what to detect in ES|QL, and how to choose and configure the right creation path for your use case.
- Alerts explains how alert episodes track a problem from first detection through recovery, and how to triage them as they come in.
- Notifications and actions shows you how to connect workflows and action policies so the right people hear about the right problems, at the right time.
Because the experimental alerting system is still evolving, its UI can change before general availability. Rather than pointing to an exact button or menu, the documentation focuses on the underlying concepts and behavior. If something doesn't match what you see in the Kibana UI, look for the closest equivalent instead. The concepts and behaviors described in the documentation still apply.