Rules in Kibana Universal Alerting

In Kibana Universal Alerting, a rule is where detection starts. It points Kibana at the data you care about, describes what counts as a problem in ES|QL, and says how often to check. On each scheduled run, Kibana writes each matching row as a rule event to .rule-events. Those events are never overwritten.

A rule doesn't send notifications. Action policies match alerts from any rule and invoke a workflow, which sends the notification. You can change how policies route alerts without changing a rule's detection logic, and several policies can respond to the same alert independently.

• Create a rule: Compare creation paths and select the one that fits your workflow.
• Configure a rule: Set the schedule, grouping, alert delay, recovery condition, and no-data behavior.
• Rule mode: Set whether matches are grouped into an alert or remain available for later analysis.
• View and manage rules: Enable, disable, clone, delete, and bulk-manage rules from the Rules page.