diff --git a/docs/user/alerting/defining-alerts.asciidoc b/docs/user/alerting/defining-alerts.asciidoc index acfb26d2e11b39..62806cf32d1592 100644 --- a/docs/user/alerting/defining-alerts.asciidoc +++ b/docs/user/alerting/defining-alerts.asciidoc @@ -56,7 +56,12 @@ To add an action to an alert, you first select the type of action: [role="screenshot"] image::images/alert-flyout-action-type-selection.png[UI for selecting an action type] -Each action must specify a <> instance. If no connectors exist for that action type, click "Add new" to create one. +When an alert instance matches a condition, the alert is marked as _Active_ and assigned an action group. The actions in that group are triggered. +When the condition is no longer detected, the alert is assigned to the _Recovered_ action group, which triggers any actions assigned to that group. + +**Run When** allows you to assign an action to an _action group_. This will trigger the action in accordance with your **Notify every** setting. + +Each action must specify a <> instance. If no connectors exist for that action type, click *Add action* to create one. Each action type exposes different properties. For example an email action allows you to set the recipients, the subject, and a message body in markdown format. See <> for details on the types of actions provided by {kib} and their properties. diff --git a/docs/user/alerting/images/alert-flyout-action-details.png b/docs/user/alerting/images/alert-flyout-action-details.png index 06287ed1837d2d..7547fc819f5390 100644 Binary files a/docs/user/alerting/images/alert-flyout-action-details.png and b/docs/user/alerting/images/alert-flyout-action-details.png differ diff --git a/docs/user/alerting/images/alert-flyout-action-variables.png b/docs/user/alerting/images/alert-flyout-action-variables.png index 73fc1fe9dea636..5b3684ad3fae48 100644 Binary files a/docs/user/alerting/images/alert-flyout-action-variables.png and b/docs/user/alerting/images/alert-flyout-action-variables.png differ