# Kibana Alerting Rules

Create and manage Kibana alerting rules.

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elastic/agent-skills --skill kibana-alerting-rules -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill kibana-alerting-rules -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill kibana-alerting-rules -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill kibana-alerting-rules -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Create and manage Kibana alerting rules. Use when creating, updating, or managing rule lifecycle (enable, disable, mute, snooze), choosing metric threshold rule types and params, or read-only find/list with tag filters.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Kibana Alerting Rules

Create, inspect, update, and manage Kibana alerting rules: choose the right rule type, encode threshold and grouping
semantics, attach actions only when requested, and list or filter rules read-only when the user asks to discover
existing coverage.

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command, always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

## Core concepts

A rule has three parts: **conditions** (`params` + `rule_type_id`), **schedule** (how often conditions are checked), and
**actions** (optional connectors run when alerts fire). When conditions are met, the rule creates **alerts**; actions
deliver notifications through **connectors**. Do not create connectors or actions unless the user explicitly asks for
notification wiring, many tasks require only the rule definition.

Required privileges: `all` on the owning Kibana feature (Stack Rules, Observability, Security, etc.) and `all` on Rules
Settings. Managing connectors needs `all` on Actions and Connectors; `read` is sufficient to attach existing connectors
as rule actions.

The rest: https://github.com/elastic/agent-skills/blob/HEAD/skills/kibana/kibana-alerting-rules/SKILL.md