An alerting rule is much like a recording rule with some additional definitions; they can even share the same rule group without any issues. The biggest difference is that, when firing, they are sent to an external endpoint via an HTTP POST with a JSON payload for further processing. Expanding on the term active, in this context, we are talking about when the current state differs from the desired state, which boils down to when an expression returns one or more samples.

Alerting rules, such as recording rules, rely on PromQL expressions that are evaluated on a defined interval. This interval can be a globally configured one or can be local to the specific rule group. In each of the interval iterations, triggered alerts are validated to ensure that they're still active; if not, they're considered to be resolved.

For every sample returned by our expression, it will trigger an alert. This is important to keep in mind, because a relaxed PromQL expression can generate a deluge of alerts, so keep them as aggregated as possible.