[ResponseOps][Alerting] Alerting v2: Director by cnasikas · Pull Request #247673 · elastic/kibana

cnasikas · 2025-12-31T11:53:16Z

Summary

Note

Dear reviewers. This PR is getting merged into a feature branch. Only the ResponseOps review is needed it at the moment. We will request for your review when we open the feature branch PR to be merged on main.

This PR implements the Director component of the alerting v2 core engine. The Director is an asynchronous state engine responsible for deriving alert state transitions (e.g., Pending → Active) from the immutable stream of raw alert events.

Architecture

Strategy Pattern

To ensure the Director remains agnostic of specific business logic, we implemented the Strategy Pattern. The Director facilitates the data flow, while an ITransitionStrategy defines the actual state machine logic. This allows us to support different transition behaviors, based on rule configuration or alert event type, without modifying the core service. It may seem overengineering at the moment, but I think it will help us in the long run. At the moment, only one strategy is supported, the BasicTransitionStrategy, which moves the states like inactive -> pending -> active -> recovering -> inactive based on a) the status of the alert event and the latest episode status if exist.

Episode Lifecycle Management

The state is calculated as:

Inactive + Breached → Pending: A new alert has started, but must wait in Pending before becoming Active.
Pending + Recoverde → Inactive: The condition cleared before it could become Active.
Active + Recovered → Recovering: An active alert has stopped breaching and enters the recovery phase.
Recovering + Breached → Active: An alert that was recovering has breached again.

The episode ID is preserved across pending, active, and recovering states. A new episode ID is generated only when transitioning from inactive to a non-inactive state (a new episode starts).

Important

Calculating the states based on counts or timeframes will be implemented on the next PR to avoid growing the size of the PR and make reviewing the fundamentals of the director easier. Same for streaming the ESQL results to the director and to the datastream.

flowchart LR
    subgraph Lifecycle["Episode Lifecycle"]
        direction LR
        
        INACTIVE((INACTIVE))
        PENDING((PENDING))
        ACTIVE((ACTIVE))
        RECOVERING((RECOVERING))
        
        INACTIVE -->|"breached<br/>New Episode ID"| PENDING
        PENDING -->|breached| ACTIVE
        ACTIVE -->|recovered| RECOVERING
        RECOVERING -->|recovered| INACTIVE
        
        RECOVERING -->|"breached<br/>"| ACTIVE
        PENDING -->|"recovered<br/>Episode Ends"| INACTIVE
    end

    style INACTIVE fill:#9e9e9e,color:#fff
    style PENDING fill:#ffc107,color:#000
    style ACTIVE fill:#f44336,color:#fff
    style RECOVERING fill:#ff9800,color:#000

Example

Alert events

Row	@timestamp	Status	Episode status	Episode ID
1	10:00	breached	pending	uuid-1
2	10:05	breached	active	uuid-1
3	10:10	recovered	recovering	uuid-1
4	10:15	recovered	recovered	uuid-1
5	10:20	breached	pending	uuid-2

Out of scope

Changed state transitions based on counts or timeframes.
Streaming of ES|QL results

Testing

Create a rule that fires breach events.
Maturation:
- Verify that the alert event documents have the correct episode status, alert event status, and the episode ID on each run.

Recovering is not possible to be tested atm as we need the rule executor to produce these alert events.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Unit or functional tests were updated or added to match the most common scenarios

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/register_task.ts

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/service.ts

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/queries.ts

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/service.ts

x-pack/platform/plugins/shared/alerting_v2/server/plugin.ts

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/constants.ts

elasticmachine · 2026-01-05T12:25:11Z

Pinging @elastic/response-ops (Team:ResponseOps)

x-pack/platform/plugins/shared/alerting_v2/server/lib/service_manager.ts

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/queries.ts

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/service.test.ts

...tform/plugins/shared/alerting_v2/server/lib/services/query_service/internal_esql_executor.ts

x-pack/platform/plugins/shared/alerting_v2/server/lib/services/query_service/query_service.ts

x-pack/platform/plugins/shared/alerting_v2/server/resources/alert_events.ts

…ally, or add an exception to src/dev/yarn_deduplicate/index.ts and then commit the changes and push to your branch

…o alerting_v2_director

Copilot

Pull request overview

This PR introduces the alerting v2 “Director” component and rewires the alerting pipeline to compute and persist episode-aware alert states using ES|QL directly via the Elasticsearch client instead of the Kibana search strategy.

Changes:

Refactors QueryService and related consumers to use esClient.esql.query with scoped/internal variants, updating ES|QL-related types and helpers.
Introduces the Director service plus transition strategies to derive episode state (inactive → pending → active → recovering → inactive) and integrates it into the rule execution steps, including a new storage step.
Updates alert event mappings and schemas to use a nested episode object, and adjusts alert event building, actions client queries, and fixtures accordingly.

Reviewed changes

Copilot reviewed 36 out of 36 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
x-pack/platform/plugins/shared/alerting_v2/tsconfig.json	Removes obsolete `@kbn/search-types` reference now that search strategy is no longer used.
x-pack/platform/plugins/shared/alerting_v2/server/setup/bind_services.ts	Binds new `QueryService` tokens, Director service, and transition strategy to the DI container.
x-pack/platform/plugins/shared/alerting_v2/server/setup/bind_rule_executor.ts	Wires new `DirectorStep` and `StoreAlertEventsStep` into the rule execution pipeline.
x-pack/platform/plugins/shared/alerting_v2/server/resources/alert_events.ts	Changes alert event mapping/schema to a nested `episode` object and renames episode-related enums/types.
x-pack/platform/plugins/shared/alerting_v2/server/lib/test_utils.ts	Switches to `DeeplyMockedApi<ElasticsearchClient>` and removes the now-unused search client helper.
x-pack/platform/plugins/shared/alerting_v2/server/lib/services/storage_service/storage_service.ts	Simplifies bulk indexing to always use `create` operations and adjusts error extraction accordingly.
x-pack/platform/plugins/shared/alerting_v2/server/lib/services/query_service/tokens.ts	Adds DI tokens for scoped and internal `QueryService` flavors.
x-pack/platform/plugins/shared/alerting_v2/server/lib/services/query_service/query_service.ts	Reimplements `QueryService` on top of `esClient.esql.query` and adapts logging and types to the ES client.
x-pack/platform/plugins/shared/alerting_v2/server/lib/services/query_service/query_service.test.ts	Updates tests to use the ES client mock and validate the new `QueryService` behavior.
x-pack/platform/plugins/shared/alerting_v2/server/lib/services/query_service/query_service.mock.ts	Provides a factory that creates a `QueryService` backed by a mocked ES client and logger.
x-pack/platform/plugins/shared/alerting_v2/server/lib/services/query_service/query_response_to_records.ts	Adjusts the helper to accept `EsqlQueryResponse` instead of the old search response type.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/types.ts	Updates pipeline state to use `EsqlQueryResponse` and store plain `AlertEvent[]`.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/type_guards.ts	Replaces specific type guards with a generic `hasState` helper for pipeline state.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/test_utils.ts	Updates ES
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/steps/wait_for_resources_step.ts	Adds structured logging around waiting for shared resources.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/steps/validate_rule_step.ts	Uses the new generic state guard and adds detailed debug logging.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/steps/store_alert_events.ts.ts	Adds a step that writes the computed alert events to the alert events data stream.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/steps/fetch_rule_step.ts	Adds debug logging for rule fetch success/failure and rule-deleted handling.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/steps/execute_rule_query_step.ts	Switches to the scoped `QueryService` token and enriches logging and row-count reporting.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/steps/execute_rule_query_step.test.ts	Adapts tests to the ES client-based query execution and new logging.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/steps/director_step.ts	Introduces a pipeline step that delegates alert events to the Director and replaces them with enriched events.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/steps/create_alert_events_step.ts	Stops writing to storage directly and instead returns constructed `AlertEvent[]` into pipeline state.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/get_query_payload.ts	Migrates query payload building to `EsqlQueryRequest` types and adapts parameter handling.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/build_alert_events.ts	Returns plain `AlertEvent` documents with updated types and removes deterministic `_id` handling.
x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/build_alert_events.test.ts	Adjusts tests to new return shape and ES
x-pack/platform/plugins/shared/alerting_v2/server/lib/director/strategies/types.ts	Defines the strategy interface and transition context for episode state transitions.
x-pack/platform/plugins/shared/alerting_v2/server/lib/director/strategies/strategy_resolver.ts	Adds a resolver that registers and returns the default transition strategy.
x-pack/platform/plugins/shared/alerting_v2/server/lib/director/strategies/strategy_resolver.test.ts	Tests that the resolver correctly registers and returns the basic strategy.
x-pack/platform/plugins/shared/alerting_v2/server/lib/director/strategies/basic_strategy.ts	Implements the basic state machine for episode transitions based on alert event status.
x-pack/platform/plugins/shared/alerting_v2/server/lib/director/strategies/basic_strategy.test.ts	Tests all main state transitions and defensive fallbacks for the basic strategy.
x-pack/platform/plugins/shared/alerting_v2/server/lib/director/queries.ts	Adds an ES
x-pack/platform/plugins/shared/alerting_v2/server/lib/director/director.ts	Implements the Director service that queries previous state and computes new episode IDs/statuses.
x-pack/platform/plugins/shared/alerting_v2/server/lib/director/director.test.ts	Provides comprehensive tests for Director state/eisode transitions and error propagation.
x-pack/platform/plugins/shared/alerting_v2/server/lib/alert_actions_client/fixtures/query_responses.ts	Updates fixtures to use `EsqlQueryResponse` types.
x-pack/platform/plugins/shared/alerting_v2/server/lib/alert_actions_client/alert_actions_client.ts	Adapts alert actions ES
x-pack/platform/plugins/shared/alerting_v2/server/lib/alert_actions_client/alert_actions_client.test.ts	Updates alert actions tests to use the ES client–backed `QueryService` mock and new fixtures.

x-pack/platform/plugins/shared/alerting_v2/server/setup/bind_rule_executor.ts

...ck/platform/plugins/shared/alerting_v2/server/lib/director/strategies/basic_strategy.test.ts

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/queries.ts

x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/steps/store_alert_events.ts

x-pack/platform/plugins/shared/alerting_v2/server/lib/rule_executor/steps/director_step.ts

darnautov

LGTM overall! Left some minor suggestions.
And a question regarding the hashes: we discussed the approach of using ES pipelines for that. Did you get a chance to experiment with it?

darnautov · 2026-02-03T12:41:07Z

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/strategies/basic_strategy.ts

+    if (!stateRules) {
+      return alertEpisodeStatus.pending;
+    }


I wonder if we should disallow unsupported states and throw an error instead?

Not sure, tbh. Do we consider it a rule failure or a graceful error due to malformed data? @mikecote Any opinion on this?

Assuming a new episode, and preferably logging the issue, make sense to me.

darnautov · 2026-02-03T12:43:25Z

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/strategies/basic_strategy.ts

+import type { ITransitionStrategy, TransitionContext } from './types';
+
+@injectable()
+export class BasicTransitionStrategy implements ITransitionStrategy {


I'd add a comment here from the PR description with the reasoning behind the transition strategy and resolver

I added a README in 13b4572.

...platform/plugins/shared/alerting_v2/server/lib/director/strategies/strategy_resolver.test.ts

darnautov · 2026-02-03T12:48:28Z

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/strategies/strategy_resolver.ts

+    this.strategies.set(strategy.name, strategy);
+  }
+
+  resolve(): ITransitionStrategy {


?

Suggested change

resolve(): ITransitionStrategy {

getDefaultStrategy(): ITransitionStrategy {

Do you mind if I go with getStrategy because very soon it will be configurable, and you can get any strategy based on some criteria?

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/strategies/strategy_resolver.ts

darnautov · 2026-02-03T12:51:25Z

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/strategies/strategy_resolver.ts

+import { BasicTransitionStrategy } from './basic_strategy';
+
+@injectable()
+export class TransitionStrategyResolver {


Should we call factory or a registry?

Ok! I will go with the factory word.

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/director.ts

cnasikas · 2026-02-03T15:04:16Z

LGTM overall! Left some minor suggestions. And a question regarding the hashes: we discussed the approach of using ES pipelines for that. Did you get a chance to experiment with it?

Not yet. We can put it as a work item for later.

elasticmachine · 2026-02-03T17:06:34Z

💔 Build Failed

Buildkite Build
Commit: b143474

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #115 / Advanced Settings security feature controls no advanced_settings privileges does not show Management navlink
[job] [logs] FTR Configs #115 / Advanced Settings security feature controls no advanced_settings privileges does not show Management navlink
[job] [logs] FTR Configs #88 / Agent Builder converse Conversation Error Handling shows error message when there is an error and allows user to retry
[job] [logs] FTR Configs #92 / API Keys app feature controls security global dashboard read with manage_security should render the "Security" section with API Keys
[job] [logs] FTR Configs #92 / API Keys app feature controls security global dashboard read with manage_security should render the "Security" section with API Keys
[job] [logs] FTR Configs #93 / apis alerting_v2 Create Alert Action API should return 204 for ack action and write action document
[job] [logs] FTR Configs #93 / apis alerting_v2 Create Alert Action API should return 204 for ack action and write action document
[job] [logs] FTR Configs #98 / Canvas Canvas app security feature controls global canvas read-only privileges shows canvas navlink
[job] [logs] FTR Configs #98 / Canvas Canvas app security feature controls global canvas read-only privileges shows canvas navlink
[job] [logs] FTR Configs #39 / Cross Cluster Replication app feature controls security global dashboard read with ccr_user "Data" section with CCR should render
[job] [logs] FTR Configs #39 / Cross Cluster Replication app feature controls security global dashboard read with ccr_user "Data" section with CCR should render
[job] [logs] FTR Configs #127 / dashboard feature controls dashboard feature controls security global dashboard read-only privileges shows dashboard navlink
[job] [logs] FTR Configs #127 / dashboard feature controls dashboard feature controls security global dashboard read-only privileges shows dashboard navlink
[job] [logs] FTR Configs #26 / Data Views feature controls security no data views privileges does not show Management navlink
[job] [logs] FTR Configs #26 / Data Views feature controls security no data views privileges does not show Management navlink
[job] [logs] FTR Configs #5 / Dev Tools feature controls security global dev_tools all privileges shows Dev Tools navlink
[job] [logs] FTR Configs #5 / Dev Tools feature controls security global dev_tools all privileges shows Dev Tools navlink
[job] [logs] FTR Configs #35 / discover - group 2 feature controls discover feature controls security global discover read-only privileges shows discover navlink
[job] [logs] FTR Configs #35 / discover - group 2 feature controls discover feature controls security global discover read-only privileges shows discover navlink
[job] [logs] Jest Integration Tests #1 / DispatcherService integration tests when some episodes already have fire-events should only dispatch the new events
[job] [logs] Jest Integration Tests #1 / DispatcherService integration tests when some episodes already have fire-events should only dispatch the new events
[job] [logs] Jest Integration Tests #1 / DispatcherService integration tests when there are alert events without prior fire-events should dispatch all unique episodes
[job] [logs] Jest Integration Tests #1 / DispatcherService integration tests when there are alert events without prior fire-events should dispatch all unique episodes
[job] [logs] Jest Integration Tests #1 / DispatcherService integration tests when there are no alert events should not dispatch any episodes
[job] [logs] Jest Integration Tests #1 / DispatcherService integration tests when there are no alert events should not dispatch any episodes
[job] [logs] FTR Configs #86 / graph app feature controls security global graph all privileges shows graph navlink
[job] [logs] FTR Configs #86 / graph app feature controls security global graph all privileges shows graph navlink
[job] [logs] FTR Configs #13 / Index Lifecycle Management app feature controls security global dashboard read with manage_ilm "Data" section with ILM should render
[job] [logs] FTR Configs #13 / Index Lifecycle Management app feature controls security global dashboard read with manage_ilm "Data" section with ILM should render
[job] [logs] FTR Configs #62 / Index Management app feature controls security global dashboard read with index_management_user "Data" section with index management should render
[job] [logs] FTR Configs #62 / Index Management app feature controls security global dashboard read with index_management_user "Data" section with index management should render
[job] [logs] FTR Configs #80 / Ingest pipelines app feature controls security global dashboard read with ingest_pipelines_user "Ingest" section with ingest pipelines should render
[job] [logs] FTR Configs #80 / Ingest pipelines app feature controls security global dashboard read with ingest_pipelines_user "Ingest" section with ingest pipelines should render
[job] [logs] FTR Configs #34 / License app feature controls security global dashboard read with license_management_user [SkipCloud] global dashboard with license management user : skip cloud should render the "Stack" section with License Management
[job] [logs] FTR Configs #34 / License app feature controls security global dashboard read with license_management_user [SkipCloud] global dashboard with license management user : skip cloud should render the "Stack" section with License Management
[job] [logs] FTR Configs #93 / logstash feature controls security global dashboard read with logstash_read_user "Ingest" section with Logstash Pipelines should render
[job] [logs] FTR Configs #93 / logstash feature controls security global dashboard read with logstash_read_user "Ingest" section with Logstash Pipelines should render
[job] [logs] FTR Configs #93 / management feature controls security no management privileges should not show the Stack Management nav link
[job] [logs] FTR Configs #93 / management feature controls security no management privileges should not show the Stack Management nav link
[job] [logs] FTR Configs #3 / maps app maps security feature controls global maps read-only privileges shows Maps navlink
[job] [logs] FTR Configs #3 / maps app maps security feature controls global maps read-only privileges shows Maps navlink
[job] [logs] FTR Configs #76 / Remote Clusters app feature controls security global dashboard read with license_management_user "Data" section with Remote Clusters should render
[job] [logs] FTR Configs #76 / Remote Clusters app feature controls security global dashboard read with license_management_user "Data" section with Remote Clusters should render
[job] [logs] FTR Configs #35 / Saved objects management feature controls saved objects management global visualize all privileges listing can't navigate to listing page
[job] [logs] FTR Configs #35 / Saved objects management feature controls saved objects management global visualize all privileges listing can't navigate to listing page
[job] [logs] FTR Configs #59 / search sessions management Search Sessions Management UI permissions Sessions management is not available if no apps enable search sessions
[job] [logs] FTR Configs #59 / search sessions management Search Sessions Management UI permissions Sessions management is not available if no apps enable search sessions
[job] [logs] FTR Configs #47 / Serverless Observability - Deployment-agnostic platform API integration tests alerting_v2 Create Alert Action API "after all" hook for "should filter by episode_id when provided in request body"
[job] [logs] FTR Configs #47 / Serverless Observability - Deployment-agnostic platform API integration tests alerting_v2 Create Alert Action API "after all" hook for "should filter by episode_id when provided in request body"
[job] [logs] FTR Configs #47 / Serverless Observability - Deployment-agnostic platform API integration tests alerting_v2 Create Alert Action API "after each" hook for "should return 204 for ack action and write action document"
[job] [logs] FTR Configs #47 / Serverless Observability - Deployment-agnostic platform API integration tests alerting_v2 Create Alert Action API "after each" hook for "should return 204 for ack action and write action document"
[job] [logs] FTR Configs #47 / Serverless Observability - Deployment-agnostic platform API integration tests alerting_v2 Create Alert Action API should return 204 for ack action and write action document
[job] [logs] FTR Configs #47 / Serverless Observability - Deployment-agnostic platform API integration tests alerting_v2 Create Alert Action API should return 204 for ack action and write action document
[job] [logs] FTR Configs #33 / transform - feature controls security global dashboard read with transform_user "Data" section with Transform should render
[job] [logs] FTR Configs #33 / transform - feature controls security global dashboard read with transform_user "Data" section with Transform should render
[job] [logs] FTR Configs #24 / transform basic license transform - feature controls security global dashboard read with transform_user "Data" section with Transform should render
[job] [logs] FTR Configs #24 / transform basic license transform - feature controls security global dashboard read with transform_user "Data" section with Transform should render
[job] [logs] FTR Configs #48 / Visualize visualize feature controls security global visualize read-only privileges shows visualize navlink
[job] [logs] FTR Configs #48 / Visualize visualize feature controls security global visualize read-only privileges shows visualize navlink

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [b545c38]

History

cc @cnasikas

@cnasikas

## Summary ### Key capabilities - **ES|QL-native rule evaluation** — Rules are defined as ES|QL queries with optional WHERE clause conditions, evaluated on a configurable schedule - **Alert lifecycle management** — Full episode tracking with pending → active → recovering → inactive state transitions, including configurable alert delay (consecutive breaches / duration) - **Event-driven architecture** — Alert events and actions are stored in dedicated data streams (`.alerting-events`, `.alerting-actions`) with ES|QL views for querying - **Notification dispatch pipeline** — A multi-step dispatcher that matches alert episodes to notification policies, handles throttling/suppression, and triggers Kibana Workflows using encrypted API keys - **Notification policies** — CRUD APIs and UI for creating notification policies with KQL-based rule matching, workflow integration, and API key management - **Rule authoring UI** — A shared rule form package (`@kbn/alerting-v2-rule-form`) usable standalone or embedded in Discover, with ES|QL editor, WHERE clause condition editing, recovery configuration, and live query preview - **Rule management UI** — Full rule list with pagination, enable/disable, clone, edit, and delete operations - **APM instrumentation** — Middleware and decorators for tracing rule execution and client operations ### Architecture highlights - **InversifyJS DI** — All services use constructor injection with typed tokens, scoped per-request or singleton as appropriate - **Pipeline pattern** — Rule executor and dispatcher use composable step-based pipelines - **Saved Objects** — Rules stored as hidden saved objects; notification policies stored as encrypted saved objects (for API key protection) - **Feature privileges** — Dedicated Kibana feature with read/all privileges for RBAC --- ## Contained PRs <details> <summary>Core Engine & Plugin Init (12 PRs)</summary> - #247283 — Init alerting v2 plugin (@cnasikas) - #247452 — Add the alerting v2 feature privileges (@cnasikas) - #247673 — Director (@cnasikas) - #248306 — Create basic services (@cnasikas) - #248696 — Initialize all resources (@cnasikas) - #250023 — Schema package (@cnasikas) - #250010 — YML Editor (@cnasikas) - #251064 — Remove index.mode: lookup for RnA alert indices (@cnasikas) - #251707 — Simplify task registration pattern (@kdelemme) - #251876 — Dedicated user service (@cnasikas) - #252073 — Use `kbn/data-streams` in alerting_v2 (@cnasikas) - #255120 — Update alerting-v2 owner to new rna project team (@cnasikas) </details> <details> <summary>Rule Execution Pipeline (12 PRs)</summary> - #247472 — Add alerting v2 Rule Executor (@darnautov) - #248285 — Alerting v2 rule HTTP APIs (@darnautov) - #248728 — Add basic alert actions route (@darnautov) - #250161 — Refactor rule executor to use a pipeline pattern (@darnautov) - #252292 — Implement the CountTimeframeStrategy for the director (@cnasikas) - #252544 — Add support of streaming in the rule executor (@darnautov) - #252754 — Update rule attributes (@kdelemme) - #253355 — Add getRules client method (@kdelemme) - #253668 — Make evaluation.query.condition optional (@kdelemme) - #254031 — Add recovery event generation to rule execution pipeline (@kdelemme) - #255968 — ES|QL views (@adcoelho) - #256697 — Create episodes ES|QL view (@adcoelho) </details> <details> <summary>Alert Suppression & Episodes (3 PRs)</summary> - #252174 — Alert suppression (@kdelemme) - #256486 — Fix suppression query (@kdelemme) - #256527 — Store 'unmatched' action for unmatched alert episodes (@kdelemme) </details> <details> <summary>Dispatcher & Notification Engine (6 PRs)</summary> - #250822 — Alerting v2 dispatcher (@kdelemme) - #251529 — Use query service in dispatcher (@kdelemme) - #251679 — Dispatcher task (@kdelemme) - #252758 — Dispatcher notification policy (@kdelemme) - #255332 — Wait for resources before scheduling dispatcher task (@kdelemme) - #256536 — Use stored encrypted API keys from Notification Policy in dispatcher step (@kdelemme) </details> <details> <summary>Notification Policies (Server) (4 PRs)</summary> - #251336 — Introduce notification policy CRUD APIs and client (@cnasikas) - #253134 — Update notification policy (@cnasikas) - #254808 — Store API key owner on Notification Policy (@kdelemme) - #256940 — Make notification policies global with optional rule-label scoping (@kdelemme) </details> <details> <summary>Notification Policies UI (1 PR)</summary> - #255599 — Add notification policies UI and Storybook form story (@adcoelho) </details> <details> <summary>Rule Authoring UI (13 PRs)</summary> - #250961 — Add create rule flyout in Discover (@adcoelho) - #255111 — Add activation configuration fields to alerting V2 rule form (@yiannisnikolopoulos) - #255427 — Rule form: provide services via context (@dominiqueclarke) - #255876 — MVP rule form, Split evaluation condition, and Recovery configuration (@dominiqueclarke) - #256260 — Foundational rule list (@dominiqueclarke) - #256756 — Wire up edit flow (@dominiqueclarke) - #256801 — Move consecutive breaches max to shared constants (@yiannisnikolopoulos) - #256818 — Preview query and design parity (@dominiqueclarke) - #256938 — Allow clearing number inputs in state transition fields (@yiannisnikolopoulos) - #257017 — Add enable/disable and clone rule to rule list (@dominiqueclarke) - #257246 — Remove all React.FC (@dominiqueclarke) - #257415 — Rule form - fix test (@dominiqueclarke) - #257454 — Block comma key in number input component (@yiannisnikolopoulos) </details> <details> <summary>API Documentation & Schema (2 PRs)</summary> - #254901 — Rename indexes for alert events and actions (@adcoelho) - #255810 — OAS for alert action routes (@adcoelho) </details> <details> <summary>Observability & Monitoring (3 PRs)</summary> - #254925 — Add ApmMiddleware to the rule executor (@adcoelho) - #255115 — Add the withAPM decorator and apply it to the rules_client (@adcoelho) - #255999 — Fix linting problem in apm middleware (@adcoelho) </details> <details> <summary>CI & Maintenance (2 PRs)</summary> - #257409 — Refactor SO services to use inversify DI for client initialization (@darnautov) - Fix alerting-v2-schema jest config (@darnautov) </details> --- --------- Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kevin Delemme <kevin.delemme@elastic.co> Co-authored-by: Mike Côté <mikecote@users.noreply.github.com> Co-authored-by: Antonio <antonio.coelho@elastic.co> Co-authored-by: Kevin Delemme <kdelemme@gmail.com> Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co> Co-authored-by: Yiannis Nikolopoulos <yiannis.nikolopoulos@elastic.co> Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Bailey Cash <bailey.cash@elastic.co> Co-authored-by: Anna Davydova <ana.davydova@elastic.co> Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com> Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com> Co-authored-by: Joana Cardoso <169058851+joana-cps@users.noreply.github.com>

@cnasikas

## Summary ### Key capabilities - **ES|QL-native rule evaluation** — Rules are defined as ES|QL queries with optional WHERE clause conditions, evaluated on a configurable schedule - **Alert lifecycle management** — Full episode tracking with pending → active → recovering → inactive state transitions, including configurable alert delay (consecutive breaches / duration) - **Event-driven architecture** — Alert events and actions are stored in dedicated data streams (`.alerting-events`, `.alerting-actions`) with ES|QL views for querying - **Notification dispatch pipeline** — A multi-step dispatcher that matches alert episodes to notification policies, handles throttling/suppression, and triggers Kibana Workflows using encrypted API keys - **Notification policies** — CRUD APIs and UI for creating notification policies with KQL-based rule matching, workflow integration, and API key management - **Rule authoring UI** — A shared rule form package (`@kbn/alerting-v2-rule-form`) usable standalone or embedded in Discover, with ES|QL editor, WHERE clause condition editing, recovery configuration, and live query preview - **Rule management UI** — Full rule list with pagination, enable/disable, clone, edit, and delete operations - **APM instrumentation** — Middleware and decorators for tracing rule execution and client operations ### Architecture highlights - **InversifyJS DI** — All services use constructor injection with typed tokens, scoped per-request or singleton as appropriate - **Pipeline pattern** — Rule executor and dispatcher use composable step-based pipelines - **Saved Objects** — Rules stored as hidden saved objects; notification policies stored as encrypted saved objects (for API key protection) - **Feature privileges** — Dedicated Kibana feature with read/all privileges for RBAC --- ## Contained PRs <details> <summary>Core Engine & Plugin Init (12 PRs)</summary> - elastic#247283 — Init alerting v2 plugin (@cnasikas) - elastic#247452 — Add the alerting v2 feature privileges (@cnasikas) - elastic#247673 — Director (@cnasikas) - elastic#248306 — Create basic services (@cnasikas) - elastic#248696 — Initialize all resources (@cnasikas) - elastic#250023 — Schema package (@cnasikas) - elastic#250010 — YML Editor (@cnasikas) - elastic#251064 — Remove index.mode: lookup for RnA alert indices (@cnasikas) - elastic#251707 — Simplify task registration pattern (@kdelemme) - elastic#251876 — Dedicated user service (@cnasikas) - elastic#252073 — Use `kbn/data-streams` in alerting_v2 (@cnasikas) - elastic#255120 — Update alerting-v2 owner to new rna project team (@cnasikas) </details> <details> <summary>Rule Execution Pipeline (12 PRs)</summary> - elastic#247472 — Add alerting v2 Rule Executor (@darnautov) - elastic#248285 — Alerting v2 rule HTTP APIs (@darnautov) - elastic#248728 — Add basic alert actions route (@darnautov) - elastic#250161 — Refactor rule executor to use a pipeline pattern (@darnautov) - elastic#252292 — Implement the CountTimeframeStrategy for the director (@cnasikas) - elastic#252544 — Add support of streaming in the rule executor (@darnautov) - elastic#252754 — Update rule attributes (@kdelemme) - elastic#253355 — Add getRules client method (@kdelemme) - elastic#253668 — Make evaluation.query.condition optional (@kdelemme) - elastic#254031 — Add recovery event generation to rule execution pipeline (@kdelemme) - elastic#255968 — ES&elastic#124;QL views (@adcoelho) - elastic#256697 — Create episodes ES&elastic#124;QL view (@adcoelho) </details> <details> <summary>Alert Suppression & Episodes (3 PRs)</summary> - elastic#252174 — Alert suppression (@kdelemme) - elastic#256486 — Fix suppression query (@kdelemme) - elastic#256527 — Store 'unmatched' action for unmatched alert episodes (@kdelemme) </details> <details> <summary>Dispatcher & Notification Engine (6 PRs)</summary> - elastic#250822 — Alerting v2 dispatcher (@kdelemme) - elastic#251529 — Use query service in dispatcher (@kdelemme) - elastic#251679 — Dispatcher task (@kdelemme) - elastic#252758 — Dispatcher notification policy (@kdelemme) - elastic#255332 — Wait for resources before scheduling dispatcher task (@kdelemme) - elastic#256536 — Use stored encrypted API keys from Notification Policy in dispatcher step (@kdelemme) </details> <details> <summary>Notification Policies (Server) (4 PRs)</summary> - elastic#251336 — Introduce notification policy CRUD APIs and client (@cnasikas) - elastic#253134 — Update notification policy (@cnasikas) - elastic#254808 — Store API key owner on Notification Policy (@kdelemme) - elastic#256940 — Make notification policies global with optional rule-label scoping (@kdelemme) </details> <details> <summary>Notification Policies UI (1 PR)</summary> - elastic#255599 — Add notification policies UI and Storybook form story (@adcoelho) </details> <details> <summary>Rule Authoring UI (13 PRs)</summary> - elastic#250961 — Add create rule flyout in Discover (@adcoelho) - elastic#255111 — Add activation configuration fields to alerting V2 rule form (@yiannisnikolopoulos) - elastic#255427 — Rule form: provide services via context (@dominiqueclarke) - elastic#255876 — MVP rule form, Split evaluation condition, and Recovery configuration (@dominiqueclarke) - elastic#256260 — Foundational rule list (@dominiqueclarke) - elastic#256756 — Wire up edit flow (@dominiqueclarke) - elastic#256801 — Move consecutive breaches max to shared constants (@yiannisnikolopoulos) - elastic#256818 — Preview query and design parity (@dominiqueclarke) - elastic#256938 — Allow clearing number inputs in state transition fields (@yiannisnikolopoulos) - elastic#257017 — Add enable/disable and clone rule to rule list (@dominiqueclarke) - elastic#257246 — Remove all React.FC (@dominiqueclarke) - elastic#257415 — Rule form - fix test (@dominiqueclarke) - elastic#257454 — Block comma key in number input component (@yiannisnikolopoulos) </details> <details> <summary>API Documentation & Schema (2 PRs)</summary> - elastic#254901 — Rename indexes for alert events and actions (@adcoelho) - elastic#255810 — OAS for alert action routes (@adcoelho) </details> <details> <summary>Observability & Monitoring (3 PRs)</summary> - elastic#254925 — Add ApmMiddleware to the rule executor (@adcoelho) - elastic#255115 — Add the withAPM decorator and apply it to the rules_client (@adcoelho) - elastic#255999 — Fix linting problem in apm middleware (@adcoelho) </details> <details> <summary>CI & Maintenance (2 PRs)</summary> - elastic#257409 — Refactor SO services to use inversify DI for client initialization (@darnautov) - Fix alerting-v2-schema jest config (@darnautov) </details> --- --------- Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kevin Delemme <kevin.delemme@elastic.co> Co-authored-by: Mike Côté <mikecote@users.noreply.github.com> Co-authored-by: Antonio <antonio.coelho@elastic.co> Co-authored-by: Kevin Delemme <kdelemme@gmail.com> Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co> Co-authored-by: Yiannis Nikolopoulos <yiannis.nikolopoulos@elastic.co> Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Bailey Cash <bailey.cash@elastic.co> Co-authored-by: Anna Davydova <ana.davydova@elastic.co> Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com> Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com> Co-authored-by: Joana Cardoso <169058851+joana-cps@users.noreply.github.com>

@cnasikas

- **ES|QL-native rule evaluation** — Rules are defined as ES|QL queries with optional WHERE clause conditions, evaluated on a configurable schedule - **Alert lifecycle management** — Full episode tracking with pending → active → recovering → inactive state transitions, including configurable alert delay (consecutive breaches / duration) - **Event-driven architecture** — Alert events and actions are stored in dedicated data streams (`.alerting-events`, `.alerting-actions`) with ES|QL views for querying - **Notification dispatch pipeline** — A multi-step dispatcher that matches alert episodes to notification policies, handles throttling/suppression, and triggers Kibana Workflows using encrypted API keys - **Notification policies** — CRUD APIs and UI for creating notification policies with KQL-based rule matching, workflow integration, and API key management - **Rule authoring UI** — A shared rule form package (`@kbn/alerting-v2-rule-form`) usable standalone or embedded in Discover, with ES|QL editor, WHERE clause condition editing, recovery configuration, and live query preview - **Rule management UI** — Full rule list with pagination, enable/disable, clone, edit, and delete operations - **APM instrumentation** — Middleware and decorators for tracing rule execution and client operations - **InversifyJS DI** — All services use constructor injection with typed tokens, scoped per-request or singleton as appropriate - **Pipeline pattern** — Rule executor and dispatcher use composable step-based pipelines - **Saved Objects** — Rules stored as hidden saved objects; notification policies stored as encrypted saved objects (for API key protection) - **Feature privileges** — Dedicated Kibana feature with read/all privileges for RBAC --- <details> <summary>Core Engine & Plugin Init (12 PRs)</summary> - elastic#247283 — Init alerting v2 plugin (@cnasikas) - elastic#247452 — Add the alerting v2 feature privileges (@cnasikas) - elastic#247673 — Director (@cnasikas) - elastic#248306 — Create basic services (@cnasikas) - elastic#248696 — Initialize all resources (@cnasikas) - elastic#250023 — Schema package (@cnasikas) - elastic#250010 — YML Editor (@cnasikas) - elastic#251064 — Remove index.mode: lookup for RnA alert indices (@cnasikas) - elastic#251707 — Simplify task registration pattern (@kdelemme) - elastic#251876 — Dedicated user service (@cnasikas) - elastic#252073 — Use `kbn/data-streams` in alerting_v2 (@cnasikas) - elastic#255120 — Update alerting-v2 owner to new rna project team (@cnasikas) </details> <details> <summary>Rule Execution Pipeline (12 PRs)</summary> - elastic#247472 — Add alerting v2 Rule Executor (@darnautov) - elastic#248285 — Alerting v2 rule HTTP APIs (@darnautov) - elastic#248728 — Add basic alert actions route (@darnautov) - elastic#250161 — Refactor rule executor to use a pipeline pattern (@darnautov) - elastic#252292 — Implement the CountTimeframeStrategy for the director (@cnasikas) - elastic#252544 — Add support of streaming in the rule executor (@darnautov) - elastic#252754 — Update rule attributes (@kdelemme) - elastic#253355 — Add getRules client method (@kdelemme) - elastic#253668 — Make evaluation.query.condition optional (@kdelemme) - elastic#254031 — Add recovery event generation to rule execution pipeline (@kdelemme) - elastic#255968 — ES&elastic#124;QL views (@adcoelho) - elastic#256697 — Create episodes ES&elastic#124;QL view (@adcoelho) </details> <details> <summary>Alert Suppression & Episodes (3 PRs)</summary> - elastic#252174 — Alert suppression (@kdelemme) - elastic#256486 — Fix suppression query (@kdelemme) - elastic#256527 — Store 'unmatched' action for unmatched alert episodes (@kdelemme) </details> <details> <summary>Dispatcher & Notification Engine (6 PRs)</summary> - elastic#250822 — Alerting v2 dispatcher (@kdelemme) - elastic#251529 — Use query service in dispatcher (@kdelemme) - elastic#251679 — Dispatcher task (@kdelemme) - elastic#252758 — Dispatcher notification policy (@kdelemme) - elastic#255332 — Wait for resources before scheduling dispatcher task (@kdelemme) - elastic#256536 — Use stored encrypted API keys from Notification Policy in dispatcher step (@kdelemme) </details> <details> <summary>Notification Policies (Server) (4 PRs)</summary> - elastic#251336 — Introduce notification policy CRUD APIs and client (@cnasikas) - elastic#253134 — Update notification policy (@cnasikas) - elastic#254808 — Store API key owner on Notification Policy (@kdelemme) - elastic#256940 — Make notification policies global with optional rule-label scoping (@kdelemme) </details> <details> <summary>Notification Policies UI (1 PR)</summary> - elastic#255599 — Add notification policies UI and Storybook form story (@adcoelho) </details> <details> <summary>Rule Authoring UI (13 PRs)</summary> - elastic#250961 — Add create rule flyout in Discover (@adcoelho) - elastic#255111 — Add activation configuration fields to alerting V2 rule form (@yiannisnikolopoulos) - elastic#255427 — Rule form: provide services via context (@dominiqueclarke) - elastic#255876 — MVP rule form, Split evaluation condition, and Recovery configuration (@dominiqueclarke) - elastic#256260 — Foundational rule list (@dominiqueclarke) - elastic#256756 — Wire up edit flow (@dominiqueclarke) - elastic#256801 — Move consecutive breaches max to shared constants (@yiannisnikolopoulos) - elastic#256818 — Preview query and design parity (@dominiqueclarke) - elastic#256938 — Allow clearing number inputs in state transition fields (@yiannisnikolopoulos) - elastic#257017 — Add enable/disable and clone rule to rule list (@dominiqueclarke) - elastic#257246 — Remove all React.FC (@dominiqueclarke) - elastic#257415 — Rule form - fix test (@dominiqueclarke) - elastic#257454 — Block comma key in number input component (@yiannisnikolopoulos) </details> <details> <summary>API Documentation & Schema (2 PRs)</summary> - elastic#254901 — Rename indexes for alert events and actions (@adcoelho) - elastic#255810 — OAS for alert action routes (@adcoelho) </details> <details> <summary>Observability & Monitoring (3 PRs)</summary> - elastic#254925 — Add ApmMiddleware to the rule executor (@adcoelho) - elastic#255115 — Add the withAPM decorator and apply it to the rules_client (@adcoelho) - elastic#255999 — Fix linting problem in apm middleware (@adcoelho) </details> <details> <summary>CI & Maintenance (2 PRs)</summary> - elastic#257409 — Refactor SO services to use inversify DI for client initialization (@darnautov) - Fix alerting-v2-schema jest config (@darnautov) </details> --- --------- Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kevin Delemme <kevin.delemme@elastic.co> Co-authored-by: Mike Côté <mikecote@users.noreply.github.com> Co-authored-by: Antonio <antonio.coelho@elastic.co> Co-authored-by: Kevin Delemme <kdelemme@gmail.com> Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co> Co-authored-by: Yiannis Nikolopoulos <yiannis.nikolopoulos@elastic.co> Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Bailey Cash <bailey.cash@elastic.co> Co-authored-by: Anna Davydova <ana.davydova@elastic.co> Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com> Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com> Co-authored-by: Joana Cardoso <169058851+joana-cps@users.noreply.github.com>

@cnasikas

- **ES|QL-native rule evaluation** — Rules are defined as ES|QL queries with optional WHERE clause conditions, evaluated on a configurable schedule - **Alert lifecycle management** — Full episode tracking with pending → active → recovering → inactive state transitions, including configurable alert delay (consecutive breaches / duration) - **Event-driven architecture** — Alert events and actions are stored in dedicated data streams (`.alerting-events`, `.alerting-actions`) with ES|QL views for querying - **Notification dispatch pipeline** — A multi-step dispatcher that matches alert episodes to notification policies, handles throttling/suppression, and triggers Kibana Workflows using encrypted API keys - **Notification policies** — CRUD APIs and UI for creating notification policies with KQL-based rule matching, workflow integration, and API key management - **Rule authoring UI** — A shared rule form package (`@kbn/alerting-v2-rule-form`) usable standalone or embedded in Discover, with ES|QL editor, WHERE clause condition editing, recovery configuration, and live query preview - **Rule management UI** — Full rule list with pagination, enable/disable, clone, edit, and delete operations - **APM instrumentation** — Middleware and decorators for tracing rule execution and client operations - **InversifyJS DI** — All services use constructor injection with typed tokens, scoped per-request or singleton as appropriate - **Pipeline pattern** — Rule executor and dispatcher use composable step-based pipelines - **Saved Objects** — Rules stored as hidden saved objects; notification policies stored as encrypted saved objects (for API key protection) - **Feature privileges** — Dedicated Kibana feature with read/all privileges for RBAC --- <details> <summary>Core Engine & Plugin Init (12 PRs)</summary> - elastic#247283 — Init alerting v2 plugin (@cnasikas) - elastic#247452 — Add the alerting v2 feature privileges (@cnasikas) - elastic#247673 — Director (@cnasikas) - elastic#248306 — Create basic services (@cnasikas) - elastic#248696 — Initialize all resources (@cnasikas) - elastic#250023 — Schema package (@cnasikas) - elastic#250010 — YML Editor (@cnasikas) - elastic#251064 — Remove index.mode: lookup for RnA alert indices (@cnasikas) - elastic#251707 — Simplify task registration pattern (@kdelemme) - elastic#251876 — Dedicated user service (@cnasikas) - elastic#252073 — Use `kbn/data-streams` in alerting_v2 (@cnasikas) - elastic#255120 — Update alerting-v2 owner to new rna project team (@cnasikas) </details> <details> <summary>Rule Execution Pipeline (12 PRs)</summary> - elastic#247472 — Add alerting v2 Rule Executor (@darnautov) - elastic#248285 — Alerting v2 rule HTTP APIs (@darnautov) - elastic#248728 — Add basic alert actions route (@darnautov) - elastic#250161 — Refactor rule executor to use a pipeline pattern (@darnautov) - elastic#252292 — Implement the CountTimeframeStrategy for the director (@cnasikas) - elastic#252544 — Add support of streaming in the rule executor (@darnautov) - elastic#252754 — Update rule attributes (@kdelemme) - elastic#253355 — Add getRules client method (@kdelemme) - elastic#253668 — Make evaluation.query.condition optional (@kdelemme) - elastic#254031 — Add recovery event generation to rule execution pipeline (@kdelemme) - elastic#255968 — ES&elastic#124;QL views (@adcoelho) - elastic#256697 — Create episodes ES&elastic#124;QL view (@adcoelho) </details> <details> <summary>Alert Suppression & Episodes (3 PRs)</summary> - elastic#252174 — Alert suppression (@kdelemme) - elastic#256486 — Fix suppression query (@kdelemme) - elastic#256527 — Store 'unmatched' action for unmatched alert episodes (@kdelemme) </details> <details> <summary>Dispatcher & Notification Engine (6 PRs)</summary> - elastic#250822 — Alerting v2 dispatcher (@kdelemme) - elastic#251529 — Use query service in dispatcher (@kdelemme) - elastic#251679 — Dispatcher task (@kdelemme) - elastic#252758 — Dispatcher notification policy (@kdelemme) - elastic#255332 — Wait for resources before scheduling dispatcher task (@kdelemme) - elastic#256536 — Use stored encrypted API keys from Notification Policy in dispatcher step (@kdelemme) </details> <details> <summary>Notification Policies (Server) (4 PRs)</summary> - elastic#251336 — Introduce notification policy CRUD APIs and client (@cnasikas) - elastic#253134 — Update notification policy (@cnasikas) - elastic#254808 — Store API key owner on Notification Policy (@kdelemme) - elastic#256940 — Make notification policies global with optional rule-label scoping (@kdelemme) </details> <details> <summary>Notification Policies UI (1 PR)</summary> - elastic#255599 — Add notification policies UI and Storybook form story (@adcoelho) </details> <details> <summary>Rule Authoring UI (13 PRs)</summary> - elastic#250961 — Add create rule flyout in Discover (@adcoelho) - elastic#255111 — Add activation configuration fields to alerting V2 rule form (@yiannisnikolopoulos) - elastic#255427 — Rule form: provide services via context (@dominiqueclarke) - elastic#255876 — MVP rule form, Split evaluation condition, and Recovery configuration (@dominiqueclarke) - elastic#256260 — Foundational rule list (@dominiqueclarke) - elastic#256756 — Wire up edit flow (@dominiqueclarke) - elastic#256801 — Move consecutive breaches max to shared constants (@yiannisnikolopoulos) - elastic#256818 — Preview query and design parity (@dominiqueclarke) - elastic#256938 — Allow clearing number inputs in state transition fields (@yiannisnikolopoulos) - elastic#257017 — Add enable/disable and clone rule to rule list (@dominiqueclarke) - elastic#257246 — Remove all React.FC (@dominiqueclarke) - elastic#257415 — Rule form - fix test (@dominiqueclarke) - elastic#257454 — Block comma key in number input component (@yiannisnikolopoulos) </details> <details> <summary>API Documentation & Schema (2 PRs)</summary> - elastic#254901 — Rename indexes for alert events and actions (@adcoelho) - elastic#255810 — OAS for alert action routes (@adcoelho) </details> <details> <summary>Observability & Monitoring (3 PRs)</summary> - elastic#254925 — Add ApmMiddleware to the rule executor (@adcoelho) - elastic#255115 — Add the withAPM decorator and apply it to the rules_client (@adcoelho) - elastic#255999 — Fix linting problem in apm middleware (@adcoelho) </details> <details> <summary>CI & Maintenance (2 PRs)</summary> - elastic#257409 — Refactor SO services to use inversify DI for client initialization (@darnautov) - Fix alerting-v2-schema jest config (@darnautov) </details> --- --------- Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kevin Delemme <kevin.delemme@elastic.co> Co-authored-by: Mike Côté <mikecote@users.noreply.github.com> Co-authored-by: Antonio <antonio.coelho@elastic.co> Co-authored-by: Kevin Delemme <kdelemme@gmail.com> Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co> Co-authored-by: Yiannis Nikolopoulos <yiannis.nikolopoulos@elastic.co> Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Bailey Cash <bailey.cash@elastic.co> Co-authored-by: Anna Davydova <ana.davydova@elastic.co> Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com> Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com> Co-authored-by: Joana Cardoso <169058851+joana-cps@users.noreply.github.com>

@cnasikas

## Summary ### Key capabilities - **ES|QL-native rule evaluation** — Rules are defined as ES|QL queries with optional WHERE clause conditions, evaluated on a configurable schedule - **Alert lifecycle management** — Full episode tracking with pending → active → recovering → inactive state transitions, including configurable alert delay (consecutive breaches / duration) - **Event-driven architecture** — Alert events and actions are stored in dedicated data streams (`.alerting-events`, `.alerting-actions`) with ES|QL views for querying - **Notification dispatch pipeline** — A multi-step dispatcher that matches alert episodes to notification policies, handles throttling/suppression, and triggers Kibana Workflows using encrypted API keys - **Notification policies** — CRUD APIs and UI for creating notification policies with KQL-based rule matching, workflow integration, and API key management - **Rule authoring UI** — A shared rule form package (`@kbn/alerting-v2-rule-form`) usable standalone or embedded in Discover, with ES|QL editor, WHERE clause condition editing, recovery configuration, and live query preview - **Rule management UI** — Full rule list with pagination, enable/disable, clone, edit, and delete operations - **APM instrumentation** — Middleware and decorators for tracing rule execution and client operations ### Architecture highlights - **InversifyJS DI** — All services use constructor injection with typed tokens, scoped per-request or singleton as appropriate - **Pipeline pattern** — Rule executor and dispatcher use composable step-based pipelines - **Saved Objects** — Rules stored as hidden saved objects; notification policies stored as encrypted saved objects (for API key protection) - **Feature privileges** — Dedicated Kibana feature with read/all privileges for RBAC --- ## Contained PRs <details> <summary>Core Engine & Plugin Init (12 PRs)</summary> - elastic#247283 — Init alerting v2 plugin (@cnasikas) - elastic#247452 — Add the alerting v2 feature privileges (@cnasikas) - elastic#247673 — Director (@cnasikas) - elastic#248306 — Create basic services (@cnasikas) - elastic#248696 — Initialize all resources (@cnasikas) - elastic#250023 — Schema package (@cnasikas) - elastic#250010 — YML Editor (@cnasikas) - elastic#251064 — Remove index.mode: lookup for RnA alert indices (@cnasikas) - elastic#251707 — Simplify task registration pattern (@kdelemme) - elastic#251876 — Dedicated user service (@cnasikas) - elastic#252073 — Use `kbn/data-streams` in alerting_v2 (@cnasikas) - elastic#255120 — Update alerting-v2 owner to new rna project team (@cnasikas) </details> <details> <summary>Rule Execution Pipeline (12 PRs)</summary> - elastic#247472 — Add alerting v2 Rule Executor (@darnautov) - elastic#248285 — Alerting v2 rule HTTP APIs (@darnautov) - elastic#248728 — Add basic alert actions route (@darnautov) - elastic#250161 — Refactor rule executor to use a pipeline pattern (@darnautov) - elastic#252292 — Implement the CountTimeframeStrategy for the director (@cnasikas) - elastic#252544 — Add support of streaming in the rule executor (@darnautov) - elastic#252754 — Update rule attributes (@kdelemme) - elastic#253355 — Add getRules client method (@kdelemme) - elastic#253668 — Make evaluation.query.condition optional (@kdelemme) - elastic#254031 — Add recovery event generation to rule execution pipeline (@kdelemme) - elastic#255968 — ES&elastic#124;QL views (@adcoelho) - elastic#256697 — Create episodes ES&elastic#124;QL view (@adcoelho) </details> <details> <summary>Alert Suppression & Episodes (3 PRs)</summary> - elastic#252174 — Alert suppression (@kdelemme) - elastic#256486 — Fix suppression query (@kdelemme) - elastic#256527 — Store 'unmatched' action for unmatched alert episodes (@kdelemme) </details> <details> <summary>Dispatcher & Notification Engine (6 PRs)</summary> - elastic#250822 — Alerting v2 dispatcher (@kdelemme) - elastic#251529 — Use query service in dispatcher (@kdelemme) - elastic#251679 — Dispatcher task (@kdelemme) - elastic#252758 — Dispatcher notification policy (@kdelemme) - elastic#255332 — Wait for resources before scheduling dispatcher task (@kdelemme) - elastic#256536 — Use stored encrypted API keys from Notification Policy in dispatcher step (@kdelemme) </details> <details> <summary>Notification Policies (Server) (4 PRs)</summary> - elastic#251336 — Introduce notification policy CRUD APIs and client (@cnasikas) - elastic#253134 — Update notification policy (@cnasikas) - elastic#254808 — Store API key owner on Notification Policy (@kdelemme) - elastic#256940 — Make notification policies global with optional rule-label scoping (@kdelemme) </details> <details> <summary>Notification Policies UI (1 PR)</summary> - elastic#255599 — Add notification policies UI and Storybook form story (@adcoelho) </details> <details> <summary>Rule Authoring UI (13 PRs)</summary> - elastic#250961 — Add create rule flyout in Discover (@adcoelho) - elastic#255111 — Add activation configuration fields to alerting V2 rule form (@yiannisnikolopoulos) - elastic#255427 — Rule form: provide services via context (@dominiqueclarke) - elastic#255876 — MVP rule form, Split evaluation condition, and Recovery configuration (@dominiqueclarke) - elastic#256260 — Foundational rule list (@dominiqueclarke) - elastic#256756 — Wire up edit flow (@dominiqueclarke) - elastic#256801 — Move consecutive breaches max to shared constants (@yiannisnikolopoulos) - elastic#256818 — Preview query and design parity (@dominiqueclarke) - elastic#256938 — Allow clearing number inputs in state transition fields (@yiannisnikolopoulos) - elastic#257017 — Add enable/disable and clone rule to rule list (@dominiqueclarke) - elastic#257246 — Remove all React.FC (@dominiqueclarke) - elastic#257415 — Rule form - fix test (@dominiqueclarke) - elastic#257454 — Block comma key in number input component (@yiannisnikolopoulos) </details> <details> <summary>API Documentation & Schema (2 PRs)</summary> - elastic#254901 — Rename indexes for alert events and actions (@adcoelho) - elastic#255810 — OAS for alert action routes (@adcoelho) </details> <details> <summary>Observability & Monitoring (3 PRs)</summary> - elastic#254925 — Add ApmMiddleware to the rule executor (@adcoelho) - elastic#255115 — Add the withAPM decorator and apply it to the rules_client (@adcoelho) - elastic#255999 — Fix linting problem in apm middleware (@adcoelho) </details> <details> <summary>CI & Maintenance (2 PRs)</summary> - elastic#257409 — Refactor SO services to use inversify DI for client initialization (@darnautov) - Fix alerting-v2-schema jest config (@darnautov) </details> --- --------- Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kevin Delemme <kevin.delemme@elastic.co> Co-authored-by: Mike Côté <mikecote@users.noreply.github.com> Co-authored-by: Antonio <antonio.coelho@elastic.co> Co-authored-by: Kevin Delemme <kdelemme@gmail.com> Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co> Co-authored-by: Yiannis Nikolopoulos <yiannis.nikolopoulos@elastic.co> Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Bailey Cash <bailey.cash@elastic.co> Co-authored-by: Anna Davydova <ana.davydova@elastic.co> Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com> Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com> Co-authored-by: Joana Cardoso <169058851+joana-cps@users.noreply.github.com>

cnasikas self-assigned this Dec 31, 2025

cnasikas force-pushed the alerting_v2_director branch from 6b3c5cc to 73a6122 Compare December 31, 2025 11:55

cnasikas added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// labels Dec 31, 2025

cnasikas commented Dec 31, 2025

View reviewed changes

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/register_task.ts Outdated Show resolved Hide resolved

cnasikas commented Dec 31, 2025

View reviewed changes

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/register_task.ts Outdated Show resolved Hide resolved

cnasikas commented Dec 31, 2025

View reviewed changes

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/service.ts Outdated Show resolved Hide resolved

mikecote reviewed Dec 31, 2025

View reviewed changes

cnasikas commented Dec 31, 2025

View reviewed changes

x-pack/platform/plugins/shared/alerting_v2/server/plugin.ts Outdated Show resolved Hide resolved

cnasikas force-pushed the alerting_v2_director branch 4 times, most recently from 7026fcc to b3059a5 Compare January 3, 2026 14:45

cnasikas commented Jan 5, 2026

View reviewed changes

x-pack/platform/plugins/shared/alerting_v2/server/lib/director/constants.ts Outdated Show resolved Hide resolved

cnasikas marked this pull request as ready for review January 5, 2026 12:25

cnasikas requested a review from a team as a code owner January 5, 2026 12:25

darnautov reviewed Jan 6, 2026

View reviewed changes

x-pack/platform/plugins/shared/alerting_v2/server/lib/service_manager.ts Outdated Show resolved Hide resolved

cnasikas marked this pull request as draft January 14, 2026 17:03

cnasikas force-pushed the alerting_v2_director branch from d4d9d96 to dc30757 Compare January 14, 2026 17:06