Connect workflows to Kibana Universal Alerting

In Kibana Universal Alerting, workflows define what happens in response to an alert, such as sending a message, calling a webhook, or opening a ticket.

How the alerting system connects to workflows

Kibana Universal Alerting starts workflows in two ways: through action policies and through alert lifecycle triggers. Both require an alert.

Action policies

Kibana evaluates action policies against alerts on a continuous schedule. When an alert passes a policy's eligibility, scope, and frequency gates, Kibana invokes the policy's workflow. For the step-by-step evaluation sequence, refer to How the dispatcher evaluates action policies.

Alert lifecycle triggers

Lifecycle triggers are event-driven triggers that start a workflow immediately when a user resolves, assigns, acknowledges, or snoozes an alert, with no scheduling or gating. Each action emits a named trigger event, such as alerting.actions.alertAssigned.

Lifecycle triggers don't fire on automatic status changes, such as when an alert becomes active or recovers based on rule evaluations. To respond to those changes, use an action policy. For the full list of trigger IDs, refer to Alert lifecycle triggers.

Note

To use workflows, your role must have the appropriate privileges and your subscription must include workflows. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for a breakdown of available features by tier.

When to use action policies or lifecycle triggers

You can use both at the same time. Each runs its own workflows without conflict.

	Action policies	Lifecycle triggers
How they run	Evaluate alerts on a continuous schedule	React immediately to a specific event
Frequency control	Apply eligibility, scope, and frequency gates	Fire exactly once per event, no gates to configure
Best for	Recurring notifications and escalation logic that runs as long as a problem persists	One-shot automations, such as opening a ticket when a user assigns an alert or posting a message when a user resolves it

Create and configure an action policy: Start routing alerts to workflows.
About action policies: Understand how action policies gate alerts before invoking a workflow.