Configure a rule in Kibana Universal Alerting

Kibana Universal Alerting rules have required settings and several optional ones. Start with the required settings, then add optional settings after you've validated the detection logic, for example by previewing results in the query sandbox when writing ES|QL directly. The following table links to a dedicated page for each setting, with field descriptions, accepted values, and when to configure it.

Setting	Description	Required
Rule mode	Controls whether matching rows are grouped into an alert or remain available for later analysis.	Required
ES\|QL query	The detection logic and the parameters available in query expressions.	Required
Schedule and lookback	How often the rule evaluates and how far back the query looks. Schedule is required; lookback is optional but strongly recommended.	Strongly recommended
Severity	Assign severity levels to alerts using a `severity` column in query output.	Optional
Grouping	Track multiple subjects (hosts, services, users) as independent alert series in one rule.	Optional
Alert delay	Reduce noise with delay modes for opening alerts. Only when matches are grouped into an alert.	Optional
Recovery condition	Whether an alert closes automatically, and how much confirmation it needs before it does. Only when matches are grouped into an alert.	Optional
No-data handling	What the rule records when the base query returns no results. Only when matches are grouped into an alert.	Optional
Tags, runbooks, and dashboards	Labels, investigation guides, and linked dashboards attached to the rule. Tags and runbooks apply only when matches are grouped into an alert. Dashboards apply to any rule.	Optional
Routing tags	Tags that link the rule's alerts to action policies with the same tag. Only when matches are grouped into an alert.	Optional