---
title: Rules in the experimental alerting system
description: Rules in the experimental alerting system define what to detect using ES|QL. Each match is written as a rule event. The rule's configuration determines whether those events are grouped into an alert episode.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Experimental since 9.5
---

# Rules in the experimental alerting system
A rule is where the experimental alerting system starts. It points Kibana at the data you care about, describes what counts as a problem in ES|QL, and says how often to check. On each scheduled run, Kibana writes each matching row as a [rule event](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference) to `.rule-events`. Those events are never overwritten. Alert episodes, action policies, and notifications all flow from those events.

## Rules don't control notifications

Rules only define *what* to detect. They don't control notifications, who gets notified, or when. That's the job of action policies, which are global objects scoped to your space that match alert episodes from any rule.
This separation means you can update notification routing without touching a rule, and have multiple action policies respond to the same rule independently.

## Create, configure, and manage rules

Use these pages to create a rule, change its settings, or review what it has detected.
- [Create a rule](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/create-a-rule): Compare creation paths and choose the one that fits your workflow.
- [Configure a rule](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-a-rule): Set the schedule, grouping, alert delay, recovery condition, and no-data behavior.
- [Rule mode](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-mode): Set whether matches are grouped into an alert episode or remain available for later analysis.
- [View and manage rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/view-manage-rules): Enable, disable, clone, delete, and bulk-manage rules from the **Rules** page.
- [Review rule execution history](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/review-rule-execution-history): Monitor rule execution outcomes across all rules in a space.
- [ES|QL query patterns](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/esql-query-patterns): Browse query patterns ordered by complexity, from a basic event filter to SLO burn rate and persistent breach detection.
- [Rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference): Understand the documents Kibana writes to `.rule-events`, and how `type` relates to episodes.
- [Query signals](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/alerts/query-signals): Query events with `type: signal` in Discover and use them as input to a rule that opens an episode.

<important>
  Because the experimental alerting system is still evolving, its UI can change before general availability. Rather than pointing to an exact button or menu, the documentation focuses on the underlying concepts and behavior. If something doesn't match what you see in the Kibana UI, look for the closest equivalent instead. The concepts and behaviors described in the documentation still apply.
</important>