Get started with Kibana Universal Alerting

• How it works: Walk through what happens after a rule runs, including how a rule's configuration determines whether matches open an alert or remain available for later analysis.
• Glossary: Look up key terms, such as alert, action policy, and rule event.
• Create your first rule: Load sample data, create a rule, and watch an alert move from breach through automatic recovery.

Before you start the tutorial, set up Kibana Universal Alerting and configure access for your role.

• Rules: Define what to detect in ES|QL, and select the creation path that fits your use case.
• Alerts: Learn how alerts track a problem from first detection through recovery, and how to triage them.
• Notifications and actions: Set up action policies that invoke workflows to notify your team.