Notifications and actions in Kibana Universal Alerting
To notify people or run automation for an alert in Kibana Universal Alerting, build a workflow and create an action policy that invokes it. Action policies act only on alerts, so the rule's mode must be Detect and respond or Alert (depending on your Elastic Stack version).
To use workflows, your role must have the appropriate privileges and your subscription must include workflows. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for a breakdown of available features by tier.
To send a notification or trigger an action from a rule in Kibana Universal Alerting:
Build a workflow that defines what to do, for example, send a message, call a webhook, open a case, or run any other automation.
Create an action policy that routes alerts to that workflow. The action policy controls which alerts qualify, how they batch, and how often it invokes the workflow.
To apply the policy to specific rules, give the policy and those rules the same routing tag. To run a workflow when a user acts on an alert, such as opening a ticket when someone assigns it, use an alert lifecycle trigger instead. For a comparison, refer to Connect workflows.
- About action policies: Understand how action policies evaluate and gate alerts.
- Create an action policy: Configure scope, grouping, frequency, and destinations.
- Examples and common scenarios: Route by severity, manage escalation, and re-notify for persistently active alerts.