--- title: Triage alerts in Kibana Universal Alerting description: Take triage actions on alerts. Acknowledge, snooze, resolve, reopen, tag, and assign alerts individually or in bulk. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/alerts/triage-alert-episodes products: - Elastic Documentation - Kibana applies_to: - Elastic Cloud Serverless: Generally available - Elastic Stack: Experimental in 9.5 --- # Triage alerts in Kibana Universal Alerting Use the **Alerts** page in Kibana Universal Alerting to triage alerts individually or in bulk. You can mark alerts as seen, silence their notifications, close or reopen them, and tag or assign them. To open the page, go to **Alerting** → **Alerts** in the Observability navigation menu, or find **Alerts** using the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/find-and-organize/find-apps-and-objects). For deeper investigation of a specific alert, refer to [Investigate alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/alerts/investigate-alert-episodes). ## Track review status Mark an alert as seen, or flag it again for follow-up, without changing its lifecycle state. | Action | Description | Scope | |---------------|------------------------------------------------------|-------| | Acknowledge | Marks the alert as seen and stops its notifications. | Alert | | Unacknowledge | Removes the seen marker and restores notifications. | Alert | ## Silence notifications Temporarily silence notifications for an alert's series, without disabling the rule. | Action | Description | Scope | |----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------| | Snooze | Silences notifications for the alert's series for a set duration, for example during a scheduled maintenance window. The rule continues to evaluate and the alert remains visible. | Series | | Unsnooze | Ends the active snooze and restores notifications immediately. Clears the snooze for all alerts sharing the same `group_hash`, not only the one you acted on. | Series | Snooze is one of several silencing mechanisms in Kibana Universal Alerting, each with a different scope. For the full comparison, refer to [Reduce notification noise](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/reduce-notification-noise). ## Close and reopen alerts Close an alert once the underlying problem is fixed, or reopen it if it turns out the problem wasn't resolved. | Action | Description | Scope | |-----------|----------------------------------------------------------------------------------------------------------------------------------------|-------| | Resolve | Closes the alert immediately, without waiting for the rule to detect recovery. | Alert | | Unresolve | Reopens an inactive alert as active, for example when the problem recurs. It continues as the same alert instead of opening a new one. | Alert | After you resolve an alert, its notifications stop and the rule doesn't reopen it. If the rule's condition still matches on its next run, a new alert starts for the series. The new alert follows the normal lifecycle, and action policies can send notifications for it. An alert you unresolve stays active on every rule run, even when the rule detects recovery. It closes only when you resolve it again. ## Organize and assign alerts Add context to an alert for filtering, routing, or ownership. | Action | Description | Scope | |------------------------------------------------------------------------|----------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Edit alert tags or Edit Tags (depending on your Elastic Stack version) | Adds or removes tags on the alert. | Elastic Cloud Serverless: Generally available Elastic Stack: Planned AlertElastic Stack: Experimental in 9.5 Series | | Edit assignee | Assigns the alert to a specific user, so others know who owns the investigation. | Alert | ## Investigate the underlying data Go to Discover to check whether the data behind an alert shows a genuine problem. | Action | Description | Scope | |------------------|-------------------------------------------------------------------------------------------|-------| | Open in Discover | Opens the rule's base ES|QL query scoped to the time window around when the alert opened. | Alert | ## Triage alerts from Kibana Classic Alerting - Elastic Cloud Serverless: Generally available - Elastic Stack: Planned To act on alerts with **Classic** in the **Source** column, your role needs [privileges in both alerting systems](/elastic/docs-content/tree/main/explore-analyze/alerting/esql/manage/configure-access#alerting-classic-alert-privileges). ### How actions affect alerts from Kibana Classic Alerting You can't unresolve or assign Kibana Classic Alerting alerts, or open them in Discover. The other actions use the matching Kibana Classic Alerting feature, so some results differ from the same action on a Kibana Universal Alerting alert: | Action | What happens to a Kibana Classic Alerting alert | |----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Acknowledge, Unacknowledge | Adds or removes the [acknowledged](/elastic/docs-content/tree/main/explore-analyze/alerting/alerts/view-alerts#acknowledge-alerts) marker. Unlike a Kibana Universal Alerting alert, the alert keeps sending notifications. | | Snooze, Unsnooze | [Snoozes](/elastic/docs-content/tree/main/explore-analyze/alerting/alerts/view-alerts#snooze-alerts) or unsnoozes this alert only. Other alerts from the same rule keep sending notifications. A snooze lasts until the time you set. If you select **Indefinitely**, the snooze lasts until you unsnooze the alert. For **Condition based** snooze, use the Kibana Classic Alerting alerts pages. | | Resolve | Marks the alert as [untracked](/elastic/docs-content/tree/main/explore-analyze/alerting/alerts/view-alerts#alert-status). Its status changes to **Inactive**, its notifications stop, and its status no longer updates. You can't undo this. | | Edit alert tags | Adds or removes tags on the alert. | ### Add alerts from Kibana Classic Alerting to a case To add a Kibana Classic Alerting alert from an Observability rule to a case, turn on the [**Classic Alerting: Show Classic Alerts table**](/elastic/docs-content/tree/main/explore-analyze/alerting/esql/setup#alerting-setup-v1-alerts-page) advanced setting in the space, then add the alert from the **Alerts (Classic)** page. Elastic Cloud Serverless: Generally available You can't add Kibana Classic Alerting alerts to cases from the **Alerts** page.