---
title: Experimental alerting system glossary
description: Definitions of key terms used throughout the experimental Kibana alerting system documentation.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/glossary
products:
  - Elastic Cloud Serverless
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Planned
---

# Experimental alerting system glossary
These terms appear throughout the experimental alerting system docs. If a term is unclear while reading, check its definition here before going further.
<definitions>
  <definition term="Action policy">
    A configuration that controls which alert episodes trigger a notification and how often. A single action policy can apply to one rule, several rules, or all rules in the space. To learn more, refer to [Notifications and actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/notifications-actions).
  </definition>
  <definition term="Alert episode">
    The complete record of one problem tracked in Alert mode, from first detection to recovery, moving through states (pending, active, recovering, inactive). To learn more, refer to [Alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/alerts).
  </definition>
  <definition term="Breach">
    A single instance when a rule's query finds a match, which may or may not open an alert episode depending on how the rule is configured. To learn more, refer to [ES|QL query](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-query).
  </definition>
  <definition term="Dispatcher">
    The background process that evaluates action policies against active alert episodes on a short interval (around 5 seconds), independent of the rule schedule. To learn more, refer to [Reduce notification noise](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/action-policies/reduce-notification-noise).
  </definition>
  <definition term="ES|QL">
    The query language every rule uses to search your data. To learn more, refer to the [ES|QL reference](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql).
  </definition>
  <definition term="Notification">
    The message or action a workflow sends (such as a Slack message, an email, or a webhook call) when an alert episode matches an action policy or a lifecycle trigger fires. To learn more, refer to [How action policies are evaluated](/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/action-policies/about-action-policies#how-action-policies-evaluated).
  </definition>
  <definition term="Rule">
    The definition of what to watch for in your data, how often to check, and what counts as a match. A rule runs on a schedule and produces signals (Signal mode) or tracks alert episodes (Alert mode). To learn more, refer to [Rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/rules).
  </definition>
  <definition term="Rule event">
    A record written to `.rule-events` every time a rule runs and its query finds a match. In Signal mode it is a signal, in Alert mode it belongs to an alert episode. To learn more, refer to [Rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference).
  </definition>
  <definition term="Severity">
    A label attached to alert episodes to indicate urgency. Severity is available as a filter in action policies so critical episodes can be routed differently from low-priority ones. To learn more, refer to [Configure rule severity](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-severity).
  </definition>
  <definition term="Signal">
    A rule event recorded when a rule runs in Signal mode. Signals are stored and queryable in Discover, but they don't open an alert episode or trigger notifications. To learn more, refer to [Rule mode](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-mode).
  </definition>
  <definition term="Threshold">
    The condition a rule uses to decide when something is worth alerting on, including how many times the condition must be met before an alert episode opens or closes. To learn more, refer to [Alert delay](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-alert-delay) and [Recovery condition](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-recovery).
  </definition>
  <definition term="Workflow">
    The automation that sends a message or runs an action (such as posting to Slack, sending an email, or calling a webhook) when an action policy or an alert episode lifecycle trigger invokes it. To learn more, refer to [Connect workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7407/explore-analyze/alerting/experimental-alerting-system/workflows-alerting).
  </definition>
</definitions>