---
title: Configure access to Kibana Universal Alerting
description: Kibana feature privileges and Elasticsearch index privileges needed to manage rules, action policies, and alerts.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/manage/configure-access
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Experimental in 9.5
---

# Configure access to Kibana Universal Alerting
To create rules, triage alerts, and configure notifications in Kibana Universal Alerting, your role needs specific Kibana feature privileges and, if you're querying alerting data in Discover, Elasticsearch index privileges. [Create or update a role](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management) and add the privileges that match the tasks your team performs.
Most privileges are under the **Universal Alerting** or **Alerting V2** category (depending on your Elastic Stack version and deployment type) in Kibana role management.
<note>
  Depending on how your rules and notifications are configured, your role might also need `read` index privileges on the indices their rules query and **Actions and Connectors: All** (under **Management**) to create or edit workflow connectors. Refer to [Kibana role management](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management) for guidance on building roles that combine privileges across features.
</note>


## Quick reference

The following table shows the minimum privileges for each activity. Higher privilege levels include the access shown here.

| To...                                                                                                                                                                                      | Minimum required                                                                                                                            |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
| Author and manage rules                                                                                                                                                                    | **Rules: All** (under **Universal Alerting**)                                                                                               |
| Monitor rule execution                                                                                                                                                                     | **Execution history: Read** (under **Universal Alerting**)                                                                                  |
| Triage alerts                                                                                                                                                                              | **Alerts: All** (under **Universal Alerting**)                                                                                              |
| Configure notifications                                                                                                                                                                    | **Action Policies: All** (under **Universal Alerting**) + **Workflows: Read** (under **Analytics** → **Workflows**)                         |
| Create rules and action policies with Elastic Agent Builder <applies-to>Elastic Cloud Serverless: Experimental</applies-to> <applies-to>Elastic Stack: Experimental since 9.5</applies-to> | **Elastic Agent Builder: Read** (under **Analytics**) + the privileges to [save what the agent creates](#alerting-agent-builder-privileges) |
| Query `.rule-events` and `.alert-actions` in Discover                                                                                                                                      | **Discover: Read** (under **Analytics** → **Discover**) + **Alerts: Read** (Elasticsearch `read` access is bundled automatically)           |
| Query `.kibana-event-log-*` in Discover                                                                                                                                                    | **Discover: Read** (under **Analytics** → **Discover**) + custom role with `read` index privilege on `.kibana-event-log-*`                  |


## Author and monitor rules

These privileges control who can create rules and review their execution history.

### Rules

The **Rules** privilege controls who can create and manage rules.

| Level    | What you can do                                  |
|----------|--------------------------------------------------|
| **All**  | Create, edit, delete, enable, and turn off rules |
| **Read** | View rules and their configuration               |

<note>
  **Rules: All** also grants access to the **Alerts** menu in Discover, which routes rule creation to the Kibana Universal Alerting rule form when the system is enabled in your space.
</note>


### View rule execution history

The **Execution history** privilege controls who can view rule execution history. Because execution history is read-only, **All** and **Read** grant the same access.

## Triage alerts

The **Alerts** privilege controls who can take triage actions on alerts.

| Level    | What you can do                                                                          |
|----------|------------------------------------------------------------------------------------------|
| **All**  | Acknowledge, unacknowledge, snooze, unsnooze, resolve, unresolve, tag, and assign alerts |
| **Read** | View alerts                                                                              |

Both levels also grant read access to the alert data streams. Refer to [Elasticsearch index access](#alerting-index-access).

### Alerts from Kibana Classic Alerting

<applies-to>
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Planned
</applies-to>

The **Alerts** page also lists Kibana Classic Alerting alerts. Your role's Kibana Classic Alerting privileges for each alert's rule type decide which of these alerts you can see and act on:
- **To view an alert**: Your role must be able to view alerts from the alert's rule type in Kibana Classic Alerting.
- **To triage an alert**: Your role needs **Alerts: All** and the Kibana Classic Alerting privileges for the alert's rule type. With **Alerts: Read**, you can't triage Kibana Classic Alerting alerts from the **Alerts** page.

For the Kibana Classic Alerting privileges, refer to [Give access to triage alerts without managing rules](/elastic/docs-content/pull/8924/explore-analyze/alerting/alerts/alerting-setup#_give_access_to_triage_alerts_without_managing_rules). To learn how each triage action affects these alerts, refer to [Triage alerts from Kibana Classic Alerting](/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts/triage-alert-episodes#triage-classic-alerts).

## Configure notifications

These privileges control who can set up the action policies that invoke workflows and the workflows that send notifications.

### Action policies

The **Action Policies** privilege controls who can manage the action policies that invoke workflows for alerts.

| Level    | What you can do                                              |
|----------|--------------------------------------------------------------|
| **All**  | Create, update, delete, snooze, and unsnooze action policies |
| **Read** | View action policies                                         |

<note>
  Having **Action Policies: All** does not include the ability to create or edit rules. Add **Rules: All** if rule management is also required.
</note>


### Workflows

Action policies invoke workflows, which send notifications. The **Workflows** privilege is set under **Analytics** → **Workflows** in Kibana role management. To create or manage action policies, your role also needs access to the workflows they reference.

| Level    | What you can do                                                                  |
|----------|----------------------------------------------------------------------------------|
| **All**  | Create and edit workflows; view and select existing workflows in action policies |
| **Read** | View and select existing workflows in action policies                            |


## Create rules and action policies with Elastic Agent Builder

<applies-to>
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Experimental since 9.5
</applies-to>

To create rules and action policies with [Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/rules/create-rules-action-policies-agent-builder), your role needs these privileges:

| To...                                     | Minimum required                                                                                                              |
|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|
| Access and use Elastic Agent Builder      | **Elastic Agent Builder: Read** (under **Analytics**)                                                                         |
| Save the rule                             | **Rules: All** (under **Universal Alerting**)                                                                                 |
| Save the action policy                    | **Action Policies: All** (under **Universal Alerting**)                                                                       |
| Select or create the workflow destination | **Workflows: Read** to select an existing workflow, or **Workflows: All** to create one (under **Analytics** → **Workflows**) |


## Query rule output and alert data

Kibana Universal Alerting writes rule output and alert data to three queryable data sources. To query them in Discover using ES|QL, your role needs Kibana feature access to Discover. For rule events and alert actions, the **Alerts** privilege also provides the Elasticsearch index access you need. Dispatch outcomes need a custom role.

### Kibana feature access

Set Discover privileges under **Analytics** → **Discover** in Kibana role management. **All** and **Read** both let you run ES|QL queries against rule events, alert actions, and execution history in Discover.

### Elasticsearch index access

Granting **Alerts: All** or **Alerts: Read** also gives the role Elasticsearch `read` access to `.rule-events` and `.alert-actions`, limited to the spaces where the role has the privilege. You don't need a custom role to query them in those spaces. For `.kibana-event-log-*`, you need a custom role.
To query `.rule-events` or `.alert-actions` across every space, grant `read` on the index in a custom role. A direct index `read` grant isn't limited by space, so the role can read data from all spaces.

| Data source           | What it stores                                                                                                                                                                                                                                                                                     | How to grant access                                                                                                                        |
|-----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|
| `.rule-events`        | One [rule event](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/rules/rule-event-field-reference) per matching row, per run                                                                                                                      | Included with the **Alerts** privilege, limited to the role's spaces. To query every space, use a custom role with `read` index privilege. |
| `.alert-actions`      | User-triggered triage records (acknowledge, snooze, resolve, assign) and system-written dispatcher records. For all `action_type` values, refer to the [field reference](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts/field-reference). | Included with the **Alerts** privilege, limited to the role's spaces. To query every space, use a custom role with `read` index privilege. |
| `.kibana-event-log-*` | Action policy dispatch outcomes written by the dispatcher: `dispatched`, `throttled`, and `unmatched`                                                                                                                                                                                              | Custom role with `read` index privilege                                                                                                    |


## Set up rules and notifications

With access configured, you're ready to:
- [Create a rule](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/rules/create-a-rule): Write the ES|QL query that defines what to detect, set whether matches are grouped into an alert, and configure grouping and thresholds.
- [Set up workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/notifications-actions): Configure the workflows that deliver notifications, such as email, Slack, or webhook messages.
- [Create action policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/action-policies/create-configure-action-policy): Define which alerts invoke a workflow, how often, and under what conditions.