---
title: Get started with Kibana Universal Alerting
description: Learn what happens after a rule runs, look up key terms, and follow a hands-on tutorial to create a rule and observe the alert lifecycle.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/get-started
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Experimental in 9.5
---

# Get started with Kibana Universal Alerting
<note>
  Looking for Kibana Classic Alerting? Refer to the [Kibana Classic Alerting overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/alerts).
</note>

- [How it works](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/get-started/how-it-works): Walk through what happens after a rule runs, including how a rule's configuration determines whether matches open an alert or remain available for later analysis.
- [Glossary](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/get-started/glossary): Look up key terms, such as alert, action policy, and rule event.
- [Create your first rule](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/get-started/create-your-first-rule): Load sample data, create a rule, and watch an alert move from breach through automatic recovery.

Before you start the tutorial, [set up Kibana Universal Alerting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/setup) and [configure access](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/manage/configure-access) for your role.

## Explore the documentation

- [Rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/rules): Define what to detect in ES|QL, and select the creation path that fits your use case.
- [Alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts): Learn how alerts track a problem from first detection through recovery, and how to triage them.
- [Notifications and actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/notifications-actions): Set up action policies that invoke workflows to notify your team.