---
title: Notifications and actions in Kibana Universal Alerting
description: How to set up notifications and actions for rules. Action policies invoke workflows, which send the notification.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/notifications-actions
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Experimental in 9.5
---

# Notifications and actions in Kibana Universal Alerting
To notify people or run automation for an alert in Kibana Universal Alerting, build a workflow and create an action policy that invokes it. Action policies act only on alerts, so the rule's [mode](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/configure-rule-mode) must be **Detect and respond** or **Alert** (depending on your Elastic Stack version).
<note>
  To use workflows, your role must have the appropriate privileges and your subscription must include workflows. Refer to the subscription page for [Elastic Cloud](https://www.elastic.co/subscriptions/cloud) and [Elastic Stack/self-managed](https://www.elastic.co/subscriptions) for a breakdown of available features by tier.
</note>


## Send notifications or trigger an action

To send a notification or trigger an action from a rule in Kibana Universal Alerting:
1. [Build a workflow](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/workflows/get-started/build-your-first-workflow) that defines what to do, for example, send a message, call a webhook, open a case, or run any other automation.
2. [Create an action policy](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/create-configure-action-policy) that routes alerts to that workflow. The action policy controls which alerts qualify, how they batch, and how often it invokes the workflow.
   <applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> To apply the policy to specific rules, give the policy and those rules the same [routing tag](/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/create-configure-action-policy#routing-tags).
   To run a workflow when a user acts on an alert, such as opening a ticket when someone assigns it, use an [alert lifecycle trigger](/elastic/docs-content/tree/main/explore-analyze/workflows/triggers/event-driven-triggers#alert-episode-lifecycle-triggers-event-driven) instead. For a comparison, refer to [Connect workflows](/elastic/docs-content/tree/main/explore-analyze/alerting/esql/workflows-alerting#when-to-use-action-policies-lifecycle-triggers).


## What to do next with action policies

- [About action policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/about-action-policies): Understand how action policies evaluate and gate alerts.
- [Create an action policy](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/create-configure-action-policy): Configure scope, grouping, frequency, and destinations.
- [Examples and common scenarios](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/common-action-policy-scenarios): Route by severity, manage escalation, and re-notify for persistently active alerts.