--- title: Compare alerting systems description: Compare Kibana Classic Alerting, Kibana Universal Alerting, and Watcher by use case and deployment type to select the right tool for your monitoring needs. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/compare-alerting-systems products: - Elastic Cloud Hosted - Elastic Cloud Serverless - Elastic Documentation - Elasticsearch - Kibana applies_to: - Elastic Cloud Serverless: Generally available - Elastic Stack: Generally available --- # Compare alerting systems Elastic offers three alerting systems, each suited to different use cases and workflows. Use this page to compare them by goal, feature, and availability. Elastic Security has its own detection rules, separate from these three systems. For threat detection, refer to [Detections and alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/solutions/security/detect-and-alert). ## Select by use case | Goal | Suggested system | Availability | |-----------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------| | Monitor metrics, logs, or uptime with ready-made rules and no query language | [Kibana Classic Alerting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/alerts) | Elastic Cloud Serverless: Generally available Elastic Stack: Generally available | | Write ES|QL to define exactly what to detect and what data each rule event carries | [Kibana Universal Alerting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/system-overview) | Elastic Cloud Serverless: Generally available Elastic Stack: Experimental in 9.5 | | Record matches as rule events with `type: signal` for later analysis, without sending notifications | [Kibana Universal Alerting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/system-overview) | Elastic Cloud Serverless: Generally available Elastic Stack: Experimental in 9.5 | | Query rule event history in Discover or build dashboards from rule event data | [Kibana Universal Alerting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/system-overview) | Elastic Cloud Serverless: Generally available Elastic Stack: Experimental in 9.5 | | Manage notification routing, grouping, and throttling in one place, reusable across rules | [Kibana Universal Alerting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/system-overview) | Elastic Cloud Serverless: Generally available Elastic Stack: Experimental in 9.5 | | Build highly custom notification logic with reusable, configurable workflows | [Kibana Universal Alerting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/system-overview) | Elastic Cloud Serverless: Generally available Elastic Stack: Experimental in 9.5 | | Build highly custom logic with scripting and chained inputs | [Watcher](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/watcher) | Elastic Stack: Generally available Elastic Cloud Serverless: Unavailable | ## Compare at a glance | | Kibana Classic Alerting | Kibana Universal Alerting | Watcher | |-------------------------------------------|-------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------| | **Best for** | Teams using built-in rule types with form-based setup | Teams that need control over detection, and over notification routing when matches are tracked as alerts | Custom alerting logic requiring scripting | | **Rule definition** | Select a rule type and fill in parameters | [Write an ES|QL query](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/rules/configure-rule-query) or use a rule builder with form-based setup | Write a JSON watch definition | | **How matches are stored** | In-place updates, limited query support | Append-only [rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts/rule-event-data-model), [queryable with ES|QL in Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover) | Watch history index | | **Notifications** | Configured per action on each rule | [Action policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/notifications-actions) invoke reusable workflows, which send the notification; policies support throttling and conditions | Action-level throttling and conditions | | **Noise reduction** | Snooze per rule or per alert, maintenance windows | Acknowledge or deactivate per alert, per-series snooze, maintenance windows, match condition routing in [action policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/action-policies/reduce-notification-noise) | Action conditions and throttling | | **Available on Elastic Cloud Serverless** | Yes | Yes, Elastic Cloud Serverless: Generally available | No | | **Available on Elastic Stack** | Yes | Yes, Elastic Stack: Experimental in 9.5 | Yes |