Route alerts by severity in Kibana Universal Alerting

To send critical and non-critical alerts to different workflows in Kibana Universal Alerting, scope one action policy per severity.

For example, you might page an on-call team for critical alerts while sending lower-severity alerts to a Slack channel for async review.

Each action policy evaluates alerts independently.

• An alert with severity: "critical" matches Action Policy A but not Action Policy B.
• An alert with severity: "high" matches Action Policy B but not Action Policy A.
• If an alert's severity changes mid-lifecycle, the action policies that match it change accordingly. For example, if an alert escalates from high to critical, Action Policy A starts matching and Action Policy B stops matching. Action Policy A fires because it has no prior notification record for that alert.

• Manage severity escalation notifications: Understand what happens when an alert that has already matched an action policy changes severity.
• Action policy reference: Look up match condition fields, grouping modes, and frequency options.
• Create and configure an action policy: Set up an action policy with match conditions.