diff --git a/docs/starlight-docs/public/images/alerting/create-anomaly-detection-rule.png b/docs/starlight-docs/public/images/alerting/create-anomaly-detection-rule.png
new file mode 100644
index 00000000..b8f86498
Binary files /dev/null and b/docs/starlight-docs/public/images/alerting/create-anomaly-detection-rule.png differ
diff --git a/docs/starlight-docs/public/images/alerting/create-forecasting-rule.png b/docs/starlight-docs/public/images/alerting/create-forecasting-rule.png
new file mode 100644
index 00000000..7f47b702
Binary files /dev/null and b/docs/starlight-docs/public/images/alerting/create-forecasting-rule.png differ
diff --git a/docs/starlight-docs/src/content/docs/alerting/unified-alerts/create-rules.mdx b/docs/starlight-docs/src/content/docs/alerting/unified-alerts/create-rules.mdx
index 29fed6bd..59ea9f04 100644
--- a/docs/starlight-docs/src/content/docs/alerting/unified-alerts/create-rules.mdx
+++ b/docs/starlight-docs/src/content/docs/alerting/unified-alerts/create-rules.mdx
@@ -111,6 +111,54 @@ A **metric rule** alerts on Prometheus time series. You write a **PromQL** expre
Metric-rule alerts are delivered through the Prometheus Alertmanager — set up where they go in [Notifications](/docs/alerting/notifications/#prometheus-rules--alertmanager-receivers), and view the resulting [routing tree](/docs/alerting/unified-alerts/routing/). Because [SLOs](/docs/slo/) deploy their burn-rate alerts as Prometheus rules, SLO breaches show up here as **Metric** rules too.
+## Anomaly detection rule
+
+An **anomaly detection rule** creates an OpenSearch anomaly detector. The detector learns the expected behavior of one or more aggregated features and identifies data points that differ from that behavior.
+
+
+
+
+
+The flyout follows four steps:
+
+
+
+1. **Define detector.** Enter a unique name and optional description. Select a compatible OpenSearch data source, one or more indices, an optional Query DSL filter, and the timestamp field. You can also store results in a custom result index.
+
+2. **Configure model.** Add up to five features. For each feature, choose an aggregation method and field. Optionally add a categorical field to detect anomalies independently for each entity, then set the detection interval, frequency, window delay, and history. Use **Suggest parameters** for recommended operation settings, or open **Advanced model parameters** to configure the shingle size.
+
+3. **Set up detector jobs.** Choose whether to start real-time detection automatically after creation. Automatic start is enabled by default.
+
+4. **Review and create.** Confirm the data source, indices, timestamp, features, category field, and schedule, then choose **Create rule**. The detector appears in the **Rules** catalog. After the model initializes, detected anomalies appear in the **Alerts** tab.
+
+
+
+For definitions of features, categorical detectors, anomaly grade, and confidence, see [Anomaly Detection](/docs/anomaly-detection/).
+
+## Forecasting rule
+
+A **forecasting rule** creates an OpenSearch forecaster that predicts an aggregated indicator over a future horizon. Creating the rule also starts the forecaster.
+
+
+
+
+
+The flyout follows two steps:
+
+
+
+1. **Define data source.** Enter a unique name and optional description. Select a compatible OpenSearch data source, indices, an optional Query DSL filter, and the timestamp field. Define the **indicator** by choosing its name, aggregation method, and field. You can also add a categorical field to generate forecasts per entity.
+
+2. **Add model parameters.** Set the forecasting interval, window delay, horizon, and history. Choose the default result index or configure a custom result index and its lifecycle settings, then choose **Create rule**. The forecaster starts and appears in the **Rules** catalog.
+
+
+
+Forecasters do not add rows to the **Alerts** tab by themselves. Use the Rules catalog to check whether a forecaster is running and to inspect or manage its definition. For forecasting concepts and result interpretation, see [Forecasting](/docs/forecasting/).
+
## Related
- [Notifications](/docs/alerting/notifications/) — route firing alerts to Slack, email, PagerDuty, and webhooks.
diff --git a/docs/starlight-docs/src/content/docs/alerting/unified-alerts/explore-alerts.mdx b/docs/starlight-docs/src/content/docs/alerting/unified-alerts/explore-alerts.mdx
index 1b72d9df..0e665f96 100644
--- a/docs/starlight-docs/src/content/docs/alerting/unified-alerts/explore-alerts.mdx
+++ b/docs/starlight-docs/src/content/docs/alerting/unified-alerts/explore-alerts.mdx
@@ -1,22 +1,32 @@
---
title: Explore Alerts
-description: Triage firing alerts in the Alerts tab — filter, read the alert timeline, and scope data sources
+description: Triage firing alerts and detected anomalies in the Alerts tab
---
import { Aside } from '@astrojs/starlight/components';
-The **Alerts** tab of the [Unified Alerts View](/docs/alerting/unified-alerts/) is where responders triage what's firing right now. It lists every alert produced by your [rules](/docs/alerting/unified-alerts/create-rules/) across the selected data sources — OpenSearch log alerts and Prometheus metric alerts in one queue.
+The **Alerts** tab of the [Unified Alerts View](/docs/alerting/unified-alerts/) is where responders triage active and historical signals. It combines OpenSearch log alerts, Prometheus metric alerts, and anomaly detector results from the selected data sources in one queue.
## The alert list
-Each row shows an alert's severity, state, message, and how long it has been active. Sort or search to find a specific alert. Select an alert to open its detail panel — **Alert Details**, **Labels**, **Annotations**, and **Raw Alert Data** — with an **Open rule** button that jumps to the rule that produced it. To edit, disable, or delete that rule, use the [Rules tab](/docs/alerting/unified-alerts/explore-rules/#inspect-and-manage-a-rule).
+Each row shows a signal's severity, state, message, start time, and duration. The **State** value is `anomaly` for anomaly results. Sort or search to find a specific alert or anomaly.
+
+Select an alert to open its detail panel — **Alert Details**, **Labels**, **Annotations**, and **Raw Alert Data** — with an **Open rule** button that jumps to the rule that produced it. To edit, disable, or delete that rule, use the [Rules tab](/docs/alerting/unified-alerts/explore-rules/#inspect-and-manage-a-resource).
+
+## Inspect anomalies
+
+Anomaly results appear directly in **All Alerts**. Results from the same detector and entity are grouped into one row with an occurrence count. Expand the row to compare the message, relative start time, and duration of each occurrence, then select an occurrence to inspect that exact anomaly.
+
+The anomaly detail panel shows the selected occurrence's grade, confidence, time, detector context, and feature values. For a detector with a categorical field, the panel includes an entity heat map and highlights the selected result. For a single-stream detector, it shows the detector's metric series without an entity heat map.
+
+If an alert is triggered by a detector result, select the alert to see the **Associated anomaly** section. It embeds the same anomaly context in the alert detail panel, and the linked anomaly is not repeated as a separate row in **All Alerts**.