elastic / elastic/docs-content

[Alerting V2][M3] Trigger workflows from rule execution outcomes (events generated, execution failed)

Open
#8,066 1 comment 0 reactions 1 assignee Claimed by @nastasha-solomon View on GitHub
alerting-v2 Team:SKI
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 21h
Merged PRs (30d)
141

Description

## Summary

Two new workflow trigger types let a workflow react directly to a rule's own execution outcome, rather than only to alert episode state changes: `alerting.ruleEventsGenerated` fires whenever a rule's evaluation produces one or more rule events, and `alerting.ruleExecutionFailed` fires when a rule's evaluation throws an error. Each trigger's payload carries rule and execution context (rule ID/tags, scheduled time, event count or error details), and a workflow can query the underlying `.rule-events` data stream with ES|QL for finer-grained processing of that run's events.

**Why this needs docs:** This introduces a new trigger category — rule-execution triggers — alongside the already-documented alert-episode lifecycle triggers, and the current docs don't mention it.

## Resources

- PR [#279147](https://github.com/elastic/kibana/pull/279147) — [Alerting v2] Rule execution workflow triggers
- Product issue: https://github.com/elastic/rna-program/issues/515

## Availability

| Channel | Details |
|---------|---------|
| **Stack** | v9.6.0 |
| **Serverless** | Jul 20–Jul 27 |
| **Feature status** | Technical preview |
| **Feature flag** | Requires the Alerting v2 preview to be enabled |

---
*Created with [Docs Quest Scanner](https://github.com/florent-leborgne/docs-quest-scanner) by @nastasha-solomon*

## Suggested edits

[Notifications and actions for the experimental alerting system](https://www.elastic.co/docs/explore-analyze/alerting/experimental-alerting-system/notifications-actions) > Send notifications or trigger an action
- **What the docs say:** "For actions that fire exactly once in response to a specific alert episode event (such as opening a ticket when an episode is assigned) use an alert episode lifecycle trigger instead of an action policy."
- **What to add:** Add a mention of rule-execution triggers (`alerting.ruleEventsGenerated`, `alerting.ruleExecutionFailed`) as a third automation surface, distinct from alert episode lifecycle triggers — these fire on the rule's own execution outcome rather than an alert episode's lifecycle event, useful for cases like notifying engineers when a detection rule itself breaks. Applies from 9.6.0 (technical preview) and in serverless.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.