---
title: Notifications and actions in Kibana Universal Alerting
description: How to set up notifications and actions for rules. Action policies invoke workflows, which send the notification.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9019/explore-analyze/alerting/esql/notifications-actions
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Planned
---

# Notifications and actions in Kibana Universal Alerting
To notify people or run automation for an alert in Kibana Universal Alerting, build a workflow and create an action policy that invokes it. Action policies act only on alerts, so the rule's [mode](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9019/explore-analyze/alerting/esql/rules/configure-rule-mode) must be **Detect and respond** or **Alert** (depending on your Elastic Stack version).
<note>
  To use workflows, your role must have the appropriate privileges and your subscription must include workflows. Refer to the subscription page for [Elastic Cloud](https://www.elastic.co/subscriptions/cloud) and [Elastic Stack/self-managed](https://www.elastic.co/subscriptions) for a breakdown of available features by tier.
</note>


## Send notifications or trigger an action

To send a notification or trigger an action from a rule in Kibana Universal Alerting:
1. [Build a workflow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9019/explore-analyze/workflows/get-started/build-your-first-workflow) that defines what to do, for example, send a message, call a webhook, open a case, or run any other automation.
2. [Create an action policy](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9019/explore-analyze/alerting/esql/action-policies/create-configure-action-policy) that routes alerts to that workflow. The action policy controls which alerts qualify, how they batch, and how often it invokes the workflow.
   To apply the policy to specific rules, give the policy and those rules the same [routing tag](/elastic/docs-content/pull/9019/explore-analyze/alerting/esql/action-policies/create-configure-action-policy#routing-tags).
   To run a workflow when a user acts on an alert, such as opening a ticket when someone assigns it, use an [alert lifecycle trigger](/elastic/docs-content/pull/9019/explore-analyze/workflows/triggers/event-driven-triggers#alert-episode-lifecycle-triggers-event-driven) instead. For a comparison, refer to [Connect workflows](/elastic/docs-content/pull/9019/explore-analyze/alerting/esql/workflows-alerting#when-to-use-action-policies-lifecycle-triggers).


## What to do next with action policies

- [About action policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9019/explore-analyze/alerting/esql/action-policies/about-action-policies): Understand how action policies evaluate and gate alerts.
- [Create an action policy](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9019/explore-analyze/alerting/esql/action-policies/create-configure-action-policy): Configure scope, grouping, frequency, and destinations.
- [Examples and common scenarios](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9019/explore-analyze/alerting/esql/action-policies/common-action-policy-scenarios): Route by severity, manage escalation, and re-notify for persistently active alerts.