Manage action policies

After you create action policies in Kibana Universal Alerting, you can view and edit their details, enable or disable them, snooze them during planned outages, and rotate their API keys. To monitor dispatcher activity and review execution outcomes, refer to Review action policy execution history.

To view your action policies, go to Alerting → Action Policies in the Observability navigation menu, or find Action Policies using the global search field.

The action policy list shows who created and last updated each policy, along with quick actions to clone or delete one. Open a policy to view or edit its scope, grouping mode, frequency, and destinations.

Deleting a rule doesn't delete the action policies that applied to its alerts. Delete those policies separately when no remaining rule needs them.

To check which alerts a policy applies to, open the policy and read Policy scope. It lists the policy's routing tags and query. A policy with neither shows This policy matches all alerts. To list the rules that open alerts and have at least one of the policy's routing tags, select See all affected rules.

You can disable an action policy so the dispatcher doesn't evaluate it for new alerts. You can snooze an action policy for a defined window so it doesn't invoke workflows during that period. The dispatcher skips action policies that aren't enabled or are snoozed.

Note

Snoozing an action policy differs from snoozing an alert. When you snooze an action policy, the dispatcher pauses and silences every alert series the action policy applies to. When you snooze an alert, you target one specific series before action policy evaluation runs, silencing it regardless of which action policy applies to it. Use alert snooze when you want to quiet a specific recurring alert without affecting other series the same action policy applies to.

During a maintenance window, action policies stop invoking workflows automatically. You don't need to configure the action policy. Rule evaluation continues and alerts are still recorded in .rule-events. Configure Maintenance windows separately, not on the action policy.

You can rotate the API key used to run an action policy's workflows without changing its scope or destinations. Use the Update API key action on one action policy or for multiple selected action policies.

On the action policies list, select one or more action policies to enable, disable, snooze, and do more in bulk. Select all selects every action policy on the current page of results. Clear the selection before changing filters if you need a different set.