---
title: Rules in Kibana Universal Alerting
description: Rules define what to detect using ES|QL. Each match is written as a rule event. The rule's configuration determines whether those events are grouped into an alert.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Experimental in 9.5
---

# Rules in Kibana Universal Alerting
<note>
  Looking for Kibana Classic Alerting? Refer to the [Kibana Classic Alerting overview](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/alerts).
</note>

In Kibana Universal Alerting, a rule is where detection starts. It points Kibana at the data you care about, describes what counts as a problem in ES|QL, and says how often to check. On each scheduled run, Kibana writes each matching row as a [rule event](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/rule-event-field-reference) to `.rule-events`. Those events are never overwritten.

## Workflows on action policies send notifications

A rule doesn't send notifications. [Action policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/about-action-policies) match alerts from any rule and invoke a workflow, which sends the notification. You can change how policies route alerts without changing a rule's detection logic, and several policies can respond to the same alert independently.

## Create, configure, and manage rules

- [Create a rule](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/create-a-rule): Compare creation paths and select the one that fits your workflow.
- [Configure a rule](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/configure-a-rule): Set the schedule, grouping, alert delay, recovery condition, and no-data behavior.
- [Rule mode](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/configure-rule-mode): Set whether matches are grouped into an alert or remain available for later analysis.
- [View and manage rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/view-manage-rules): Enable, disable, clone, delete, and bulk-manage rules from the **Rules** page.