Add OOB alerts and alert rule template as asset type #3537

karenzone · 2025-10-17T23:41:24Z

Related:
#2760

This PR:

Adds OOB alert rules for Elastic Agent
Adds alert templates to list of assets included with integrations
Restructures content for better flow and to replace several notes and admonitions with heads for better scanability and SEO performance

To Do:

Confirm license requirements in content and subscription page
List alerts
Add example(s) of alerts as integration assets

github-actions · 2025-10-20T00:30:18Z

🔍 Preview links for changed docs

karenzone · 2025-10-20T00:36:58Z

cc:/ @nimarezainia @MichelLosier @nchaulet @kpollich Here's a draft. Please let me know what you think, and we can iterate.

nimarezainia · 2025-10-20T03:40:07Z

Thank you @karenzone
For the Elastic Agent ootb rules we need to provide more detail IMO. Examples of some of these alerts (as documented I the issue) and what they provide the user. @MichelLosier has explained them here for the alerts that will be in the package.

I think we need to document the alert name, condition it is looking for and a blurb description for it (which could just be copy+past from the issue).

Regarding the alerts as integration assets: if we have an example to show that would be great. I know that this content is very much dependent on what the package owner adds to their package.

reference/fleet/alert-templates.md

reference/fleet/manage-integrations.md

MichelLosier · 2025-10-21T17:50:02Z

reference/fleet/alert-templates.md

+
+## {{agent}} out-of-the-box alert rules [ea-alert-rules]
+
+When you install or upgrade {{agent}}, a new alert rule is created automatically. You can configure and customize out-of-the-box alerts to get them up and running quickly. 


a new alert rule is created automatically

We'll be installing several alerting rules

vishaangelova

Thank you @karenzone! LGMT 🚀 Just left some small suggestions for your consideration.

vishaangelova · 2025-10-22T07:00:40Z

reference/fleet/manage-integrations.md

-:::{tip}
-Once you've started using integrations to ingest data, you can customize how that data is managed over time. Refer to [Index lifecycle management](/reference/fleet/data-streams.md#data-streams-ilm) to learn more.
-:::
+After you've started using integrations to ingest data, you can customize how the data is managed over time. Refer to [Index lifecycle management](/reference/fleet/data-streams.md#data-streams-ilm) to learn more.


Suggested change

After you've started using integrations to ingest data, you can customize how the data is managed over time. Refer to [Index lifecycle management](/reference/fleet/data-streams.md#data-streams-ilm) to learn more.

After you've started using integrations to ingest data, you can customize how the data is managed over time. Refer to [{{ilm-cap}}](/reference/fleet/data-streams.md#data-streams-ilm) to learn more.

vishaangelova · 2025-10-22T07:02:36Z

reference/fleet/alert-templates.md

+mapped_pages:
+  - https://www.elastic.co/guide/en/fleet/current/data-streams.html


Suggested change

mapped_pages:

- https://www.elastic.co/guide/en/fleet/current/data-streams.html

vishaangelova · 2025-10-22T07:08:17Z

reference/fleet/alert-templates.md

+::::{note}
+The built-in alerts feature for {{agent}} is available only for some subscription levels. The license (or a trial license) must be in place before you install or upgrade {{agent}} before this feature is available. 
+
+Refer [Elastic subscriptions](https://www.elastic.co/subscriptions) for more information. 


Suggested change

Refer [Elastic subscriptions](https://www.elastic.co/subscriptions) for more information.

Refer to [Elastic subscriptions](https://www.elastic.co/subscriptions) for more information.

vishaangelova · 2025-10-22T07:13:30Z

reference/fleet/alert-templates.md

+::::
+
+In {{kib}}, you can enable out-of-the-box rules pre-configured with reasonable defaults to provide immediate value for managing agents.
+You can use [ES|QL](/explore-analyze/discover/try-esql.md) to author conditions for each rule.


Suggested change

You can use [ES|QL](/explore-analyze/discover/try-esql.md) to author conditions for each rule.

You can use [{{esql}}](/explore-analyze/discover/try-esql.md) to author conditions for each rule.

vishaangelova · 2025-10-22T07:14:10Z

reference/fleet/alert-templates.md

+When you install or upgrade {{agent}}, new alert rules are created automatically. You can configure and customize out-of-the-box alerts to get them up and running quickly. 
+
+::::{note}
+The built-in alerts feature for {{agent}} is available only for some subscription levels. The license (or a trial license) must be in place before you install or upgrade {{agent}} before this feature is available. 


To remove one of the “before”-s, maybe:

Suggested change

The built-in alerts feature for {{agent}} is available only for some subscription levels. The license (or a trial license) must be in place before you install or upgrade {{agent}} before this feature is available.

The built-in alerts feature for {{agent}} is available only for some subscription levels. To use this feature, the license (or a trial license) must be in place before you install or upgrade {{agent}}.

vishaangelova · 2025-10-22T07:15:37Z

reference/fleet/alert-templates.md

+You can use [ES|QL](/explore-analyze/discover/try-esql.md) to author conditions for each rule.
+
+Connectors are not added to rules automatically, but you can attach a connector to route alerts to your platform of choice -- Slack or email, for example.
+In addition, you can add filters for policies, tags, or hostnames to scope alerts to specific sets of agents  


Suggested change

In addition, you can add filters for policies, tags, or hostnames to scope alerts to specific sets of agents

In addition, you can add filters for policies, tags, or hostnames to scope alerts to specific sets of agents.

vishaangelova · 2025-10-22T07:20:07Z

reference/fleet/alert-templates.md

+Connectors are not added to rules automatically, but you can attach a connector to route alerts to your platform of choice -- Slack or email, for example.
+In addition, you can add filters for policies, tags, or hostnames to scope alerts to specific sets of agents  
+
+You can find these rules in **Stack Management** > **Alerts and Insights** > **Rules**.


According to the style guide, we need to use → here, but I’ve seen others use >, and I’d be happy with >, too. Maybe we should discuss this with the team, and if we can agree > is also a valid option (or is the preferred option), we could update the style guide.

vishaangelova · 2025-10-22T07:23:09Z

reference/fleet/alert-templates.md

+You can find these rules in **Stack Management** > **Alerts and Insights** > **Rules**.
+
+
+## Alert templates assets for integrations [alert-templates]


Maybe?

Suggested change

## Alert templates assets for integrations [alert-templates]

## Alert template assets for integrations [alert-templates]

vishaangelova · 2025-10-22T07:25:51Z

reference/fleet/alert-templates.md

+
+## Alert templates assets for integrations [alert-templates]
+
+Some integration packages include alerting rule template assets that provide pre-made definitions of alerting rules. You can use the templates to create your own custom alerting rules that you can enable and fine tune. 


Suggested change

Some integration packages include alerting rule template assets that provide pre-made definitions of alerting rules. You can use the templates to create your own custom alerting rules that you can enable and fine tune.

Some integration packages include alerting rule template assets that provide pre-made definitions of alerting rules. You can use the templates to create your own custom alerting rules that you can enable and fine-tune.

Alert rule template as asset type

b79810b

karenzone self-assigned this Oct 17, 2025

github-actions bot had a problem deploying to docs-preview October 17, 2025 23:42 Failure

Add alert templates

9c59a26

github-actions bot had a problem deploying to docs-preview October 20, 2025 00:20 Failure

karenzone changed the title ~~Alert rule template as asset type~~ Add OOB alerts and alert rule template as asset type Oct 20, 2025

Merge branch 'main' into 2760-alert-rule

c1eb956

github-actions bot deployed to docs-preview October 20, 2025 00:28 View deployment

karenzone marked this pull request as ready for review October 20, 2025 00:34

karenzone requested a review from a team as a code owner October 20, 2025 00:34

vishaangelova reviewed Oct 20, 2025

View reviewed changes

reference/fleet/alert-templates.md Show resolved Hide resolved

vishaangelova reviewed Oct 20, 2025

View reviewed changes

reference/fleet/manage-integrations.md Show resolved Hide resolved

vishaangelova requested a review from a team October 20, 2025 11:22

MichelLosier reviewed Oct 21, 2025

View reviewed changes

Merge branch 'main' into 2760-alert-rule

f272cca

github-actions bot deployed to docs-preview October 21, 2025 20:12 View deployment

Incorporate review comments

346c963

github-actions bot deployed to docs-preview October 21, 2025 20:19 View deployment

nimarezainia approved these changes Oct 21, 2025

View reviewed changes

vishaangelova approved these changes Oct 22, 2025

View reviewed changes


		## {{agent}} out-of-the-box alert rules [ea-alert-rules]

		When you install or upgrade {{agent}}, a new alert rule is created automatically. You can configure and customize out-of-the-box alerts to get them up and running quickly.

	After you've started using integrations to ingest data, you can customize how the data is managed over time. Refer to [Index lifecycle management](/reference/fleet/data-streams.md#data-streams-ilm) to learn more.
	After you've started using integrations to ingest data, you can customize how the data is managed over time. Refer to [{{ilm-cap}}](/reference/fleet/data-streams.md#data-streams-ilm) to learn more.

		mapped_pages:
		- https://www.elastic.co/guide/en/fleet/current/data-streams.html

	Refer [Elastic subscriptions](https://www.elastic.co/subscriptions) for more information.
	Refer to [Elastic subscriptions](https://www.elastic.co/subscriptions) for more information.

	You can use [ES\|QL](/explore-analyze/discover/try-esql.md) to author conditions for each rule.
	You can use [{{esql}}](/explore-analyze/discover/try-esql.md) to author conditions for each rule.

	The built-in alerts feature for {{agent}} is available only for some subscription levels. The license (or a trial license) must be in place before you install or upgrade {{agent}} before this feature is available.
	The built-in alerts feature for {{agent}} is available only for some subscription levels. To use this feature, the license (or a trial license) must be in place before you install or upgrade {{agent}}.

	In addition, you can add filters for policies, tags, or hostnames to scope alerts to specific sets of agents
	In addition, you can add filters for policies, tags, or hostnames to scope alerts to specific sets of agents.

		You can find these rules in Stack Management > Alerts and Insights > Rules.


		## Alert templates assets for integrations [alert-templates]

	## Alert templates assets for integrations [alert-templates]
	## Alert template assets for integrations [alert-templates]


		## Alert templates assets for integrations [alert-templates]

		Some integration packages include alerting rule template assets that provide pre-made definitions of alerting rules. You can use the templates to create your own custom alerting rules that you can enable and fine tune.

Add OOB alerts and alert rule template as asset type #3537

Are you sure you want to change the base?

Add OOB alerts and alert rule template as asset type #3537

Conversation

karenzone commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

karenzone commented Oct 20, 2025

Uh oh!

nimarezainia commented Oct 20, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vishaangelova left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vishaangelova Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vishaangelova Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

karenzone commented Oct 17, 2025 •

edited

Loading

github-actions bot commented Oct 20, 2025 •

edited

Loading

vishaangelova left a comment •

edited

Loading

vishaangelova Oct 22, 2025 •

edited

Loading

vishaangelova Oct 22, 2025 •

edited

Loading