[role="xpack"]
[[rule-types]]
== Rule types

A rule is a set of <<alerting-concepts-conditions, conditions>>, <<alerting-concepts-scheduling, schedules>>, and <<alerting-concepts-actions, actions>> that enable notifications. {kib} provides rules built into the {stack} and rules registered by one of the {kib} apps.
You can create most rules types in <<create-and-manage-rules,{stack-manage-app} > {rules-ui}>>. For information on creating security rules, refer to {security-guide}/rules-ui-create.html[Create a detection rule].

[NOTE]
==============================================
Some rule types are subscription features, while others are free features.
For a comparison of the Elastic subscription levels,
see {subscriptions}[the subscription page].
==============================================

[float]
[[stack-rules]]
=== Stack rules

<<create-and-manage-rules, Stack rules>> are built into {kib}. To access the *Stack Rules* feature and create and edit rules, users require the `all` privilege. See <<kibana-feature-privileges, feature privileges>> for more information.

[cols="2*<"]
|===

| <<rule-type-es-query>>
| Run a user-configured {es} query, compare the number of matches to a configured threshold, and schedule actions to run when the threshold condition is met.

| <<rule-type-index-threshold>>
| Aggregate field values from documents using {es} queries, compare them to threshold values, and schedule actions to run when the thresholds are met.

| {ref}/transform-alerts.html[{transform-cap} rules]
| beta:[] Run scheduled checks on a {ctransform} to check its health. If a {ctransform} meets the conditions, an alert is created and the associated action is triggered.

| <<geo-alerting, Tracking containment>>
| Run an {es} query to determine if any documents are currently contained in any boundaries from a specified boundary index and generate alerts when a rule's conditions are met.

|===

[float]
[[observability-rules]]
=== {observability} rules

{observability} rules are categorized into APM and {user-experience}, Logs, Metrics, {stack-monitor-app}, and Uptime.

[NOTE]
==============================================
If you create a rule in the {observability} app, its alerts are not visible in
*{stack-manage-app} > {rules-ui}*. They are visible only in the {observability} app.
==============================================

[cols="2*<"]
|===


| <<apm-alerts, APM and User Experience>>
| Detect complex conditions in *APM* data and trigger built-in actions when the conditions are met.

| {observability-guide}/logs-threshold-alert.html[Logs rules]
| Detect complex conditions in the {logs-app}.

| {observability-guide}/metrics-threshold-alert.html[Metrics rules]
| Detect complex conditions in the {metrics-app}.

| {observability-guide}/slo-burn-rate-alert.html[SLO burn rate rule]
| Detect when the burn rate is above a defined threshold.

| {observability-guide}/monitor-status-alert.html[Uptime rules]
| Detect complex conditions in the {uptime-app}.

|===

[float]
[[ml-rules]]
=== Machine learning rules

beta:[] {ml-docs}/ml-configuring-alerts.html[{ml-cap} rules] run scheduled checks on an {anomaly-job} to detect anomalies with certain conditions. If an anomaly meets the conditions, an alert is created and the associated action is triggered.

[float]
[[security-rules]]
=== Security rules

Security rules detect suspicious source events with pre-built or custom rules and create alerts when a rule's conditions are met. For more information, refer to {security-guide}/prebuilt-rules.html[Security rules].

[NOTE]
==============================================
Alerts associated with security rules are visible only in the {security-app};
they are not visible in *{stack-manage-app} > {rules-ui}*.
==============================================

include::rule-types/index-threshold.asciidoc[leveloffset=+1]
include::rule-types/es-query.asciidoc[leveloffset=+1]
include::rule-types/geo-rule-types.asciidoc[leveloffset=+1]
