Rule mode in Kibana Universal Alerting

Rule mode decides what happens when a Kibana Universal Alerting rule finds a match. The match can raise an alert that your team triages and gets notified about, or it can become a record that you query later.

Every rule runs in one of these modes:

Mode What it does
Detect and respond (Alert in earlier Elastic Stack versions) Opens a tracked alert that Kibana follows as the condition persists and recovers. Alerts appear on the Alerts page for triage, and action policies can route them to workflows that notify your team.
Collect evidence (Signal in earlier Elastic Stack versions) Records each match as a rule event that you can query in Discover, chart on a dashboard, or feed into a later rule. Matches never appear on the Alerts page and never notify anyone.

Select Detect and respond when:

  • The query is ready for production, and you want each breach tracked as a distinct alert that opens, escalates, and closes when the condition clears.
  • Your team triages, acknowledges, or escalates what the rule finds.
  • You want action policies to invoke workflows when alerts open, escalate, or recover.
  • You need to know how long a condition has been active or how it changes state. Matches recorded by Collect evidence carry no lifecycle.

Select Collect evidence when:

  • You're still tuning the query and want to see what it catches without paging your on-call team. Preview the query in the query sandbox, then create the rule when the query is ready.
  • You want to build detection history that you can query later, without adding alert noise.
  • Nobody needs a notification when the condition fires. These matches reach no action policy.

Set either mode when you create the rule, using the rule form or YAML editor. In YAML, the mode is set in the kind field. To learn more, refer to the YAML rule schema reference.

Note

You can't change the mode after you save the rule. To use the other mode, create a new rule, or create a copy of an existing rule and set the mode before you save it.

You're writing a new detection query and want to verify it produces the results you expect before anyone gets paged. Preview the query in the query sandbox or in Discover, then create the rule in the mode you want to keep.

To record matches without opening alerts or triggering notifications, create a rule that records rule events. If you later want those matches tracked as alerts, create a separate rule that opens an alert. You can reuse the same query, or write a follow-on query that reads those events from .rule-events. For the follow-on pattern, refer to Correlate events in a follow-on rule.

You have a checkout service error rate rule and want on-call engineers notified when it fires. Create the rule so each breach opens a tracked alert that action policies can route to a workflow. The rule's alerts appear on the Alerts page, and any action policy whose scope matches them can invoke a workflow.

  • Configure a rule: All configurable rule settings, required and optional.
  • Query rule events: Query events with type: signal in Discover, build dashboards, and use them as input to a rule that opens an alert.
  • Rule events: What Kibana writes to .rule-events and how type relates to rule kind.