Configure access to Kibana Universal Alerting

To create rules, triage alerts, and configure notifications in Kibana Universal Alerting, your role needs specific Kibana feature privileges and, if you're querying alerting data in Discover, Elasticsearch index privileges. Create or update a role and add the privileges that match the tasks your team performs.

Most privileges are under the Universal Alerting or Alerting V2 category (depending on your Elastic Stack version and deployment type) in Kibana role management.

Note

Depending on how your rules and notifications are configured, your role might also need read index privileges on the indices their rules query and Actions and Connectors: All (under Management) to create or edit workflow connectors. Refer to Kibana role management for guidance on building roles that combine privileges across features.

The following table shows the minimum privileges for each activity. Higher privilege levels include the access shown here.

To... Minimum required
Author and manage rules Rules: All (under Universal Alerting)
Monitor rule execution Execution history: Read (under Universal Alerting)
Triage alerts Alerts: All (under Universal Alerting)
Configure notifications Action Policies: All (under Universal Alerting) + Workflows: Read (under Analytics → Workflows)
Create rules and action policies with Elastic Agent Builder Elastic Agent Builder: Read (under Analytics) + the privileges to save what the agent creates
Query .rule-events and .alert-actions in Discover Discover: Read (under Analytics → Discover) + Alerts: Read (Elasticsearch read access is bundled automatically)
Query .kibana-event-log-* in Discover Discover: Read (under Analytics → Discover) + custom role with read index privilege on .kibana-event-log-*

These privileges control who can create rules and review their execution history.

The Rules privilege controls who can create and manage rules.

Level What you can do
All Create, edit, delete, enable, and turn off rules
Read View rules and their configuration
Note

Rules: All also grants access to the Alerts menu in Discover, which routes rule creation to the Kibana Universal Alerting rule form when the system is enabled in your space.

The Execution history privilege controls who can view rule execution history. Because execution history is read-only, All and Read grant the same access.

The Alerts privilege controls who can take triage actions on alerts.

Level What you can do
All Acknowledge, unacknowledge, snooze, unsnooze, resolve, unresolve, tag, and assign alerts
Read View alerts

Both levels also grant read access to the alert data streams. Refer to Elasticsearch index access.

The Alerts page also lists Kibana Classic Alerting alerts. Your role's Kibana Classic Alerting privileges for each alert's rule type decide which of these alerts you can see and act on:

  • To view an alert: Your role must be able to view alerts from the alert's rule type in Kibana Classic Alerting.
  • To triage an alert: Your role needs Alerts: All and the Kibana Classic Alerting privileges for the alert's rule type. With Alerts: Read, you can't triage Kibana Classic Alerting alerts from the Alerts page.

For the Kibana Classic Alerting privileges, refer to Give access to triage alerts without managing rules. To learn how each triage action affects these alerts, refer to Triage alerts from Kibana Classic Alerting.

These privileges control who can set up the action policies that invoke workflows and the workflows that send notifications.

The Action Policies privilege controls who can manage the action policies that invoke workflows for alerts.

Level What you can do
All Create, update, delete, snooze, and unsnooze action policies
Read View action policies
Note

Having Action Policies: All does not include the ability to create or edit rules. Add Rules: All if rule management is also required.

Action policies invoke workflows, which send notifications. The Workflows privilege is set under Analytics → Workflows in Kibana role management. To create or manage action policies, your role also needs access to the workflows they reference.

Level What you can do
All Create and edit workflows; view and select existing workflows in action policies
Read View and select existing workflows in action policies

To create rules and action policies with Elastic Agent Builder, your role needs these privileges:

To... Minimum required
Access and use Elastic Agent Builder Elastic Agent Builder: Read (under Analytics)
Save the rule Rules: All (under Universal Alerting)
Save the action policy Action Policies: All (under Universal Alerting)
Select or create the workflow destination Workflows: Read to select an existing workflow, or Workflows: All to create one (under Analytics → Workflows)

Kibana Universal Alerting writes rule output and alert data to three queryable data sources. To query them in Discover using ES|QL, your role needs Kibana feature access to Discover. For rule events and alert actions, the Alerts privilege also provides the Elasticsearch index access you need. Dispatch outcomes need a custom role.

Set Discover privileges under Analytics → Discover in Kibana role management. All and Read both let you run ES|QL queries against rule events, alert actions, and execution history in Discover.

Granting Alerts: All or Alerts: Read also gives the role Elasticsearch read access to .rule-events and .alert-actions, limited to the spaces where the role has the privilege. You don't need a custom role to query them in those spaces. For .kibana-event-log-*, you need a custom role.

To query .rule-events or .alert-actions across every space, grant read on the index in a custom role. A direct index read grant isn't limited by space, so the role can read data from all spaces.

Data source What it stores How to grant access
.rule-events One rule event per matching row, per run Included with the Alerts privilege, limited to the role's spaces. To query every space, use a custom role with read index privilege.
.alert-actions User-triggered triage records (acknowledge, snooze, resolve, assign) and system-written dispatcher records. For all action_type values, refer to the field reference. Included with the Alerts privilege, limited to the role's spaces. To query every space, use a custom role with read index privilege.
.kibana-event-log-* Action policy dispatch outcomes written by the dispatcher: dispatched, throttled, and unmatched Custom role with read index privilege

With access configured, you're ready to:

  • Create a rule: Write the ES|QL query that defines what to detect, set whether matches are grouped into an alert, and configure grouping and thresholds.
  • Set up workflows: Configure the workflows that deliver notifications, such as email, Slack, or webhook messages.
  • Create action policies: Define which alerts invoke a workflow, how often, and under what conditions.