---
title: Kibana Universal Alerting overview
description: Kibana Universal Alerting writes each match as a rule event, then either groups those events into an alert with notifications or keeps them available for later analysis.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/system-overview
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Experimental in 9.5
---

# Kibana Universal Alerting overview
Use Kibana Universal Alerting to detect conditions in your Elasticsearch data with ES|QL rules. You can track each problem as an alert from first detection through recovery and route its notifications through reusable action policies, or record matches for later analysis without sending notifications.
<note>
  Looking for Kibana Classic Alerting? Refer to the [Kibana Classic Alerting overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/alerts) instead. The two systems are separate, so APIs and instructions for one don't apply to the other.
</note>

<admonition title="Where to find Kibana Universal Alerting pages in each version">
  - <applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> Go to **Alerting** in the Observability navigation menu.
  - <applies-to>Elastic Stack: Experimental in 9.5</applies-to> Go to **Stack Management** → **Alerting V2 Preview**. The UI also calls an alert an **alert episode**. For example, the **Notify per** option for one notification per alert is **Episode** instead of **Alert**.
</admonition>


## The building blocks

In Kibana Universal Alerting, you create and configure rules, action policies, and workflows. Kibana generates the other two building blocks, rule events and alerts, from your rules' matches.
- [Rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/rules): Define what to watch for in your data and how often to check.
- [Rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/rules/rule-event-field-reference): Record each match as a document in `.rule-events`.
- [Alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts): Track one problem from first detection through recovery, so you triage one lifecycle per problem.
- [Action policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/notifications-actions): Decide whether and when to invoke a workflow for an alert. You configure this on the policy, so you can change notifications without changing what each rule detects.
- [Workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/workflows-alerting): Send the notification or run the automation, for example posting to Slack, sending an email, or calling a webhook.


## How the pieces fit together


A rule evaluates your data on a schedule, and Kibana writes each match as a rule event. The rule's configuration determines the next step:
- **Alert**: Kibana groups the event into an alert. An action policy evaluates the alert and can invoke a workflow, which sends the notification or runs the automation.
- **No alert**: The event stays in `.rule-events` for later analysis. You can [query it in Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts/query-signals), build dashboards, or feed it into another rule. These events (`type: signal`) don't appear on the **Alerts** page and aren't evaluated by action policies or lifecycle triggers.

For a step-by-step walkthrough of what happens after a rule runs, refer to [How it works](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/get-started/how-it-works).

## Get started or go deeper

- [Get started](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/get-started): Learn how the system works and its key terms, then create your first rule in a hands-on tutorial.
- [Set up Kibana Universal Alerting](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/setup): Check the requirements, then turn the system on or off.
- [Manage](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/manage): Give your team the role privileges it needs, and manage the API keys that authorize rules, action policies, and workflows.
- [Rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/rules): Define what to watch for in ES|QL, and decide which creation path fits your use case.
- [Alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts): Learn how alerts track a problem from first detection through recovery, and how to triage them.
- [Notifications and actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/notifications-actions): Learn how action policies decide when to invoke a workflow, and how workflows send the notification.