Manage action policies
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Planned
Planned
After you create action policies in Kibana Universal Alerting, you can view and edit their details, enable or disable them, snooze them during planned outages, and rotate their API keys. To monitor dispatcher activity and review execution outcomes, refer to Review action policy execution history.
To view your action policies, go to Alerting → Action Policies in the Observability navigation menu, or find Action Policies using the global search field.
The action policy list shows who created and last updated each policy, along with quick actions to clone or delete one. Open a policy to view or edit its scope, grouping mode, frequency, and destinations.
Deleting a rule doesn't delete the action policies that applied to its alerts. Delete those policies separately when no remaining rule needs them.
To check which alerts a policy applies to, open the policy and read Policy scope. It lists the policy's routing tags and query. A policy with neither shows This policy matches all alerts. To list the rules that open alerts and have at least one of the policy's routing tags, select See all affected rules.
You can disable an action policy so the dispatcher doesn't evaluate it for new alerts. You can snooze an action policy for a defined window so it doesn't invoke workflows during that period. The dispatcher skips action policies that aren't enabled or are snoozed.
Snoozing an action policy differs from snoozing an alert. When you snooze an action policy, the dispatcher pauses and silences every alert series the action policy applies to. When you snooze an alert, you target one specific series before action policy evaluation runs, silencing it regardless of which action policy applies to it. Use alert snooze when you want to quiet a specific recurring alert without affecting other series the same action policy applies to.
During a maintenance window, action policies stop invoking workflows automatically. You don't need to configure the action policy. Rule evaluation continues and alerts are still recorded in .rule-events. Configure Maintenance windows separately, not on the action policy.
You can rotate the API key used to run an action policy's workflows without changing its scope or destinations. Use the Update API key action on one action policy or for multiple selected action policies.
On the action policies list, select one or more action policies to enable, disable, snooze, and do more in bulk. Select all selects every action policy on the current page of results. Clear the selection before changing filters if you need a different set.
- Create and configure an action policy: Set up or update the action policies you manage here.
- Review action policy execution history: Check dispatcher outcomes and investigate unexpected notification behavior.
- Reduce notification noise: Silence alerts by acknowledging, snoozing, or resolving them.