--- title: Experimental alerting system overview description: The experimental Kibana alerting system uses ES|QL rules to detect conditions, then either track matches as alert episodes with notifications or record signals for later analysis. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/system-overview products: - Elastic Cloud Serverless - Kibana applies_to: - Elastic Cloud Serverless: Experimental - Elastic Stack: Experimental since 9.5 --- # Experimental alerting system overview The experimental alerting system in Kibana watches your Elasticsearch data continuously, so your team doesn't have to. You define the conditions that matter, and select whether each match opens a tracked alert episode or records a signal for later analysis. The system handles the rest. In the generally available Kibana alerting system, the term **alert** refers to a tracked occurrence of a rule condition. In the experimental alerting system, the equivalent concept is called an **alert episode**. GA alerting APIs, UI, and instructions that reference alerts don't apply to alert episodes, and experimental alerting system APIs, UI, and instructions that reference alert episodes don't apply to alerts. ## The core idea The experimental alerting system starts with a rule evaluating your data. When the rule detects a match, either the system acts by creating an alert episode or the rule records the match as a signal. ![Flowchart showing that after a rule detects a match, either the system acts by creating an alert episode or the rule records a signal](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/images/basic-system-flow.png) Because acting and recording are independent, you can switch a rule between Signal mode and Alert mode as your needs change, for example, testing a rule in Signal mode before switching it to Alert mode and setting up notifications. Notifications are handled separately from rules by action policies, so you can also update where notifications go for many rules at once, without editing each rule. ## The building blocks The experimental alerting system is built from five objects: rules, alert episodes, action policies, workflows, and signals. A rule is the starting point, and its mode determines how the rule handles matches. ### Rules A rule defines what to watch for in your data and how often to check. It runs in one of two modes: Alert mode or Signal mode. The rule's mode decides how the match is handled. In Alert mode, an alert episode is created to track the match. In Signal mode, the match is recorded as a signal. Refer to [Rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/experimental-alerting-system/rules) to learn more. ### Alert episodes In Alert mode, one alert episode is created per match. The episode moves through states (pending, active, recovering, inactive), giving you one lifecycle to triage rather than a separate item per rule check. Alert episodes are passed to action policies for evaluation. Refer to [Alert episodes](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/experimental-alerting-system/alerts) to learn more. ### Action policies An action policy is the gating layer between an alert episode and a workflow. It decides whether and when to invoke a workflow by evaluating episode eligibility, match conditions, and frequency. A policy's configuration determines its scope, so one policy can cover alert episodes from a specific rule, multiple rules, or all rules in the space. This means you can change notification routing without touching any rule. Refer to [Notifications and actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/experimental-alerting-system/notifications-actions) to learn more. ### Workflows A workflow is what actually sends the notification or runs the automation, for example, posting to Slack, sending an email, calling a webhook. It's the last stop on the Act path, invoked in one of two ways: an action policy routes an alert episode to it based on match conditions and frequency, or an alert episode's lifecycle triggers invoke it immediately in response to a specific event, such as when the episode is activated or assigned. Refer to [Connect workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/experimental-alerting-system/workflows-alerting) to learn more. ### Signals In Signal mode, a match is recorded as a signal, which skips action policy evaluation entirely. As signals accumulate, you can query them in Discover, build dashboards from them, or feed them into an Alert mode rule that correlates activity across sources, feeding back into the start of the flow. Refer to [Observe and analyze signals](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/experimental-alerting-system/observe-and-analyze-signals) to learn more. ## How the pieces fit together Together, these five objects form two main paths, which diverge based on a rule's mode: 1. A rule evaluates your data and detects a match. 2. Depending on the rule's mode, the rule acts on the match (Alert mode) or records it (Signal mode): - **Alert mode**: An alert episode is created. An action policy evaluates the episode and decides whether and when to invoke a workflow. - **Signal mode**: The match is recorded as a signal, which skips action policy evaluation and workflow invocation entirely. ![Flowchart showing that after a rule finds a match, it either acts by creating an alert episode that an action policy evaluates and routes to trigger notifications or actions or records a signal that doesn't trigger notifications or actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/images/detailed-system-flow.png) ## Get started or go deeper - **New to the experimental alerting system?** [Get started](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/experimental-alerting-system/get-started) walks you through enabling the system, setting up role access, and creating your first rule with a hands-on tutorial. - **Wondering what you can detect?** [Rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/experimental-alerting-system/rules) shows you how to define what to watch for in ES|QL, and how to choose and configure the right creation path for your use case. - **Curious what happens when something breaks?** [Alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/experimental-alerting-system/alerts) explains how alert episodes track a problem from first detection through recovery, and how to triage them as they come in. - **Recording observations without notifying?** [Observe and analyze signals](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/experimental-alerting-system/observe-and-analyze-signals) shows you how to query signals in Discover and build dashboards from it. - **Want the right people to know when it matters?** [Notifications and actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7816/explore-analyze/alerting/experimental-alerting-system/notifications-actions) shows you how workflows and action policies decide who gets notified, and when.