Connect workflows to Kibana Universal Alerting
In Kibana Universal Alerting, workflows define what happens in response to an alert, such as sending a message, calling a webhook, or opening a ticket.
Kibana Universal Alerting starts workflows in two ways: through action policies and through alert lifecycle triggers. Both require an alert.
Kibana evaluates action policies against alerts on a continuous schedule. When an alert passes a policy's eligibility, scope, and frequency gates, Kibana invokes the policy's workflow. For the step-by-step evaluation sequence, refer to How the dispatcher evaluates action policies.
Lifecycle triggers are event-driven triggers that start a workflow immediately when a user resolves, assigns, acknowledges, or snoozes an alert, with no scheduling or gating. Each action emits a named trigger event, such as alerting.actions.alertAssigned (alerting.episodeAssigned in earlier versions).
Lifecycle triggers don't fire on automatic status changes, such as when an alert becomes active or recovers based on rule evaluations. To respond to those changes, use an action policy. For the full list of trigger IDs, refer to Alert lifecycle triggers.
To use workflows, your role must have the appropriate privileges and your subscription must include workflows. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for a breakdown of available features by tier.
You can use both at the same time. Each runs its own workflows without conflict.
| Action policies | Lifecycle triggers | |
|---|---|---|
| How they run | Evaluate alerts on a continuous schedule | React immediately to a specific event |
| Frequency control | Apply eligibility, scope, and frequency gates | Fire exactly once per event, no gates to configure |
| Best for | Recurring notifications and escalation logic that runs as long as a problem persists | One-shot automations, such as opening a ticket when a user assigns an alert or posting a message when a user resolves it |
- Create and configure an action policy: Start routing alerts to workflows.
- About action policies: Understand how action policies gate alerts before invoking a workflow.