[Alerting V2][Serverless & 9.5][M2] Add experimental alerting features overview pages

[nastasha-solomon]

Summary

Contributes to https://github.com/elastic/docs-content-internal/issues/919. This PR contains content that introduces the alerting v2 system.

Review requests

This PR needs a technical and editorial review. Instructions for each are below.

🔧 Technical reviewer

Please focus your review on accuracy of facts, names, and structure only. For example, please verify that field names, values, and descriptions in reference material are accurate and match the current implementation. When reviewing conceptual material, please check that definitions are technically accurate and reflect the current engineering design.

✏️ Editorial reviewer

This PR adds three pages that introduce the alerting v2 system alongside the existing Elastic alerting options: an overview of the experimental alerting system with a key concepts glossary, a comparison and selection guide across all three Elastic alerting systems, and an overview (alerting.md) that frames all three systems for readers arriving at the section root.

Please focus on writing quality, clarity, and how the content serves a reader who is seeing this system for the first time.

🚫 What to skip for now

Do not flag or review the following. I'll be fixing them after EAH:

• Any section marked [CONTENT NEEDED] is intentionally incomplete pending UI finalization or technical confirmation.
• The rule-alert-mode-diagram.png and rule-detect-mode-diagram.png images are outdated or don't align with the examples.

Terminology

• The glossary defines Breach as "the moment when a rule's query finds a match," but the Alert and Detect mode flow descriptions use "finds something" and "finds a match" instead. Check whether "breach" should appear in the flow descriptions to connect the terminology, or whether the current phrasing is clearer for a reader who hasn't memorized the glossary yet.

Clarity and reader framing

• kibana-alerting-experimental.md: The "core idea" section frames the motivation as avoiding the need to edit every rule when notification routing changes. Does this land clearly for a first-time reader, or does it read more like an internal architectural concern than a user benefit?
• choose-an-alerting-system.md: The Noise reduction row in "Compare at a glance" uses terms that require prior knowledge of the system (per-episode acknowledge or deactivate, per-series snooze, match condition routing in action policies). Check whether a reader who arrives at this page without reading the overview can make sense of this row, or whether it will only land for readers who already know the system.

Page name	Description	File	Preview	✏️ Ready for editorial review	🔧 Ready for technical review
Experimental alerting system overview	v2 alerting overview with concepts glossary	explore-analyze/alerting/kibana-alerting-experimental.md	Preview	✅	❌
Choose an alerting system	Comparison and selection guide for all three Elastic alerting systems	explore-analyze/alerting/choose-an-alerting-system.md	Preview	✅	❌
Alerting	Revised section overview describing all three systems with consistent naming	explore-analyze/alerting.md	Preview	✅	❌

Note on toc.yml conflicts: Each PR in this series adds entries to the same section of toc.yml. Merge these PRs in order and resolve toc.yml conflicts at each step.

🤖 Generated with Claude Code

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• explore-analyze/alerting.md
• explore-analyze/alerting/choose-an-alerting-system.md
• explore-analyze/alerting/kibana-alerting-experimental.md

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
explore-analyze/alerting/kibana-alerting-experimental.md	120	Elastic.Spelling	'cooldown' is a possible misspelling.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[alaudazzi]

A few suggestions for your consideration:

1/ The landing page could be simplified :
- Explain what the alerting system is
- Introduce the three alerting systems (kibana, experimental, watcher) with a shorter paragraph + link to the relevant get started
- Highlight how you can choose among the three systems (this only appears in the TOC)
- Reduce the number of admonitions (Note, Tips)

2/ To make content more actionable, consider using the "stepper" feature in the various sections under Kibana alerting (Getting started with alerts, Set up, Create and manage rules, View and manage alerts, Query alert indices)

3/ On the explore-analyze/alerting.md there seems to be a mismatch across H2

---

[alaudazzi]

Nice work! I left a few suggestions, mainly related to the overall structure and navigation.
Shall we also reconsider the quantity of admonitions? On the View and manage alerts from Kibana alerting rules page there are 3 Notes, 3 Tips, 1 Important, and 1 Warning.

[alexandra5000]

I'm not really familiar with alerting, but I left some comments anyway 😎 Take them or leave them!

The one I feel is maybe the most important is the one regarding the "core idea" section, which should be easily understandable even for a person with little to no prior knowledge on the subject. You may not see it as confusing because of your familiarity with the subject matter.

[alexandra5000]

Suggested change

	| **Noise reduction** | Snooze per rule, maintenance windows | Per-episode acknowledge or deactivate; per-series snooze; maintenance windows; match condition routing in action policies | Action conditions and throttling |
	| **Noise reduction** | Snooze per rule, maintenance windows | Per-episode acknowledge or deactivate; per-series snooze; maintenance windows; match condition routing in action policies. Refer to [{{alerting-v2-system-cap}} overview](kibana-alerting-experimental.md) for more information | Action conditions and throttling |

I know you're aware of it being rather jargon-y and hard to understand "at a glance", I also get why you wouldn't want to clutter the table, but maybe a link here wouldn't hurt? But if you feel the target reader/user will know what that's about, then it may not be necessary after all.