Triage alerts in Kibana Universal Alerting
Use the Alerts page in Kibana Universal Alerting to triage alerts individually or in bulk. You can mark alerts as seen, silence their notifications, close or reopen them, and tag or assign them. To open the page, go to Alerting → Alerts in the Observability navigation menu, or find Alerts using the global search field.
For deeper investigation of a specific alert, refer to Investigate alerts.
Mark an alert as seen, or flag it again for follow-up, without changing its lifecycle state.
| Action | Description | Scope |
|---|---|---|
| Acknowledge | Marks the alert as seen and stops its notifications. | Alert |
| Unacknowledge | Removes the seen marker and restores notifications. | Alert |
Temporarily silence notifications for an alert's series, without disabling the rule.
| Action | Description | Scope |
|---|---|---|
| Snooze | Silences notifications for the alert's series for a set duration, for example during a scheduled maintenance window. The rule continues to evaluate and the alert remains visible. | Series |
| Unsnooze | Ends the active snooze and restores notifications immediately. Clears the snooze for all alerts sharing the same group_hash, not only the one you acted on. |
Series |
Snooze is one of several silencing mechanisms in Kibana Universal Alerting, each with a different scope. For the full comparison, refer to Reduce notification noise.
Close an alert once the underlying problem is fixed, or reopen it if it turns out the problem wasn't resolved.
| Action | Description | Scope |
|---|---|---|
| Resolve | Closes the alert immediately, without waiting for the rule to detect recovery. | Alert |
| Unresolve | Reopens an inactive alert as active, for example when the problem recurs. It continues as the same alert instead of opening a new one. | Alert |
After you resolve an alert, its notifications stop and the rule doesn't reopen it. If the rule's condition still matches on its next run, a new alert starts for the series. The new alert follows the normal lifecycle, and action policies can send notifications for it.
An alert you unresolve stays active on every rule run, even when the rule detects recovery. It closes only when you resolve it again.
Add context to an alert for filtering, routing, or ownership.
| Action | Description | Scope |
|---|---|---|
| Edit alert tags or Edit Tags (depending on your Elastic Stack version) | Adds or removes tags on the alert. |
|
| Edit assignee | Assigns the alert to a specific user, so others know who owns the investigation. | Alert |
Go to Discover to check whether the data behind an alert shows a genuine problem.
| Action | Description | Scope |
|---|---|---|
| Open in Discover | Opens the rule's base ES|QL query scoped to the time window around when the alert opened. | Alert |
To act on alerts with Classic in the Source column, your role needs privileges in both alerting systems.
You can't unresolve or assign Kibana Classic Alerting alerts, or open them in Discover. The other actions use the matching Kibana Classic Alerting feature, so some results differ from the same action on a Kibana Universal Alerting alert:
| Action | What happens to a Kibana Classic Alerting alert |
|---|---|
| Acknowledge, Unacknowledge | Adds or removes the acknowledged marker. Unlike a Kibana Universal Alerting alert, the alert keeps sending notifications. |
| Snooze, Unsnooze | Snoozes or unsnoozes this alert only. Other alerts from the same rule keep sending notifications. A snooze lasts until the time you set. If you select Indefinitely, the snooze lasts until you unsnooze the alert. For Condition based snooze, use the Kibana Classic Alerting alerts pages. |
| Resolve | Marks the alert as untracked. Its status changes to Inactive, its notifications stop, and its status no longer updates. You can't undo this. |
| Edit alert tags | Adds or removes tags on the alert. |
To add a Kibana Classic Alerting alert from an Observability rule to a case, turn on the Classic Alerting: Show Classic Alerts table advanced setting in the space, then add the alert from the Alerts (Classic) page.