Notifications and actions in Kibana Universal Alerting

To notify people or run automation for an alert in Kibana Universal Alerting, build a workflow and create an action policy that invokes it. Action policies act only on alerts, so the rule's mode must be Detect and respond or Alert (depending on your Elastic Stack version).

To send a notification or trigger an action from a rule in Kibana Universal Alerting:

1. Build a workflow that defines what to do, for example, send a message, call a webhook, open a case, or run any other automation.

2. Create an action policy that routes alerts to that workflow. The action policy controls which alerts qualify, how they batch, and how often it invokes the workflow.

   To apply the policy to specific rules, give the policy and those rules the same routing tag.

   To run a workflow when a user acts on an alert, such as opening a ticket when someone assigns it, use an alert lifecycle trigger instead. For a comparison, refer to Connect workflows.

• About action policies: Understand how action policies evaluate and gate alerts.
• Create an action policy: Configure scope, grouping, frequency, and destinations.
• Examples and common scenarios: Route by severity, manage escalation, and re-notify for persistently active alerts.