--- title: Kibana Universal Alerting glossary description: Definitions of key terms used throughout the documentation, such as alert, action policy, and rule event. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/get-started/glossary products: - Elastic Cloud Serverless - Elastic Documentation - Kibana applies_to: - Elastic Cloud Serverless: Generally available - Elastic Stack: Experimental in 9.5 --- # Kibana Universal Alerting glossary These terms appear throughout the Kibana Universal Alerting documentation. A configuration that controls which alerts invoke a workflow and how often. A single action policy can apply to alerts from one rule, several rules, or every rule in the space. To learn more, refer to [Notifications and actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/notifications-actions). The complete record of one problem, from first detection to recovery, moving through states (pending, active, recovering, inactive). An alert is the grouping of [rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/rule-event-field-reference) that share `episode.id`. To learn more, refer to [Alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/alerts). A matching row from a rule run. Kibana writes each breach as a [rule event](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/rule-event-field-reference). To learn more, refer to [ES|QL query](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/configure-rule-query). The background process that evaluates action policies against eligible alerts on a short interval (around 5 seconds), independent of the rule schedule. To learn more, refer to [Reduce notification noise](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/reduce-notification-noise). The language the system uses to evaluate your data. Some creation paths generate the query for you. To learn more, refer to the [ES|QL reference](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/query-languages/esql). The message or action a workflow sends (such as a Slack message, an email, or a webhook call) when an alert matches an action policy or a lifecycle trigger fires. To learn more, refer to [How the dispatcher evaluates action policies](/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/about-action-policies#how-action-policies-evaluated). A tag that links rules to an action policy. When a rule and an action policy share a routing tag, the policy applies to that rule's alerts. Routing tags are separate from rule tags, which only label and filter rules. To learn more, refer to [Apply the policy to alerts from specific rules](/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/create-configure-action-policy#routing-tags). The definition of what to watch for in your data, what counts as a match, and how often to check. The rule's [mode](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/configure-rule-mode) determines whether its matches open alerts. To learn more, refer to [Rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules). A record Kibana writes to `.rule-events` for each matching row in a rule run. Kibana never overwrites these events. Events with `type: alert` belong to an [alert](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/alerts), and events with `type: signal` are signals. To learn more, refer to [Rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/rule-event-field-reference). A label stored on rule events when the query emits a recognized value. Action policies use it only for alerts, so critical alerts can be routed differently from low-priority ones. To learn more, refer to [Configure rule severity](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/configure-rule-severity). A [rule event](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/rule-event-field-reference) with `type: signal`, kept in `.rule-events` for later analysis. Signals don't appear on the **Alerts** page and don't start workflows. To learn more, refer to [Query rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/alerts/query-signals) and [Rule mode](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/configure-rule-mode). The condition a rule uses to decide when something is worth alerting on, including how many times the condition must be met before an alert opens or closes. To learn more, refer to [Alert delay](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/configure-rule-alert-delay) and [Recovery condition](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/configure-rule-recovery). The automation that sends a message or runs an action (such as posting to Slack, sending an email, or calling a webhook) when an action policy or an alert lifecycle trigger invokes it. To learn more, refer to [Connect workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/workflows-alerting).