--- title: Alert analysis workflow description: Configure the Elastic-managed Security alert analysis workflow that classifies alerts with AI, writes verdicts to notes and tags, and can auto-close high-confidence false positives. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7815/explore-analyze/workflows/use-cases/security/automate-security-operations/alert-analysis-workflow products: - Elastic Cloud Enterprise - Elastic Cloud Hosted - Elastic Cloud Serverless - Elastic Cloud on Kubernetes - Elastic Security - Elastic Stack - Kibana applies_to: - Elastic Cloud Serverless: Experimental - Elastic Stack: Experimental since 9.5 --- # Alert analysis workflow The **Alert analysis workflow** is a [managed workflow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7815/explore-analyze/workflows/managed-workflows) for Elastic Security. When a detection rule that has the workflow attached generates an alert, or when you run the workflow manually, the workflow gathers related context, sends it to an Elastic Agent Builder agent, and writes a classification verdict (true positive, false positive, or inconclusive) back to the alert, including confidence and rationale. Elastic installs a single shared workflow definition that's available in every Kibana space, including spaces created later. Elastic maintains the YAML, and you configure how the workflow runs per space on the **Alert analysis workflow** settings page. ## Before you begin You must have the appropriate subscription. Refer to the subscription page for [Elastic Cloud](https://www.elastic.co/subscriptions/cloud) and [Elastic Stack/self-managed](https://www.elastic.co/subscriptions) for the breakdown of available features and their associated subscription tiers. To open and save the **Alert analysis workflow** settings page, you also need the following [Kibana privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7815/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges): - `All` for **Management → Advanced Settings**. - `All` for **Security → Rules and Exceptions**. - **Update managed workflows** under **Analytics → Workflows → Managed Workflows Actions**. You also need a configured [AI connector](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7815/deploy-manage/manage-connectors) for the agent to call. To view the managed workflow itself on the **Workflows** page, turn on the [**Show managed workflows**](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/advanced-settings#kibana-workflows-settings) advanced setting and grant managed read privileges. Refer to [Show managed workflows](/elastic/docs-content/pull/7815/explore-analyze/workflows/get-started/setup#workflows-managed-visibility). ## How it works For each alert it analyzes, the workflow: 1. Gathers context such as related alerts, rule and MITRE details, how similar alerts were closed, and how noisy the rule is. 2. Sends that context to an LLM through Elastic Agent Builder. 3. Writes a started note on the alert's notes, then updates it with a verdict (true positive, false positive, or inconclusive, with confidence and rationale) or an error note if analysis fails. 4. Adds workflow tags to the alert. The tag prefix is configurable and defaults to `alert-analysis`. 5. Auto-closes the alert when the verdict is a high-confidence false positive within the configured confidence range (on by default; range defaults to 0.85–1). 6. Creates an Elastic Agent Builder conversation and links it from the verdict note (on by default). ## Set up the workflow To configure the **Alert analysis workflow** in the current space and attach it to detection rules, follow these steps: Find **Alert analysis workflow** in the navigation menu or use the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7815/explore-analyze/find-and-organize/find-apps-and-objects). In the page description, you can select **View workflow** to open the managed workflow definition. The YAML is read-only. Set how the workflow runs in the current space: | Setting | Description | |-----------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Workflow enabled** | Turns the workflow on or off everywhere it is configured, including for any rules it is attached to. Defaults to on. | | **AI connector** | The AI connector used to classify alerts. | | **Agent** | The Elastic Agent Builder agent that analyzes alerts. Defaults to the built-in Elastic AI Agent. The list includes that default plus your custom agents. | | **Create conversation** | When on, the agent creates a new conversation for each alert analysis. Defaults to on. Turn off to avoid accumulating large numbers of conversations. | | **Auto-close alerts classified as false positives** | When on, the workflow automatically closes alerts classified as false positives within the configured confidence range. Defaults to on. | | **Auto-close minimum confidence score** | Lowest false-positive confidence score (0–1) that can auto-close an alert. Defaults to `0.85`. Must be lower than the maximum when auto-close is on. | | **Auto-close maximum confidence score** | Highest false-positive confidence score (0–1) that can auto-close an alert. Defaults to `1`. | | **Alert tag prefix** | Prefix for tags the workflow adds to analyzed alerts (default `alert-analysis`). Example: `alert-analysis.classification.false_positive`. The field can't be empty. If you change the prefix, alerts tagged under the old prefix are no longer recognized as already analyzed. | Click **Save alert analysis workflow settings** to persist changes for the current space. The settings page includes a **Detection rules** section, where you can search rules by name, filter them by attachment status, and bulk attach or remove the workflow from rules.You can also attach the workflow from the rule settings, the same way as any other workflow. Refer to [Alert triggers > Configure the alert rule](/elastic/docs-content/pull/7815/explore-analyze/workflows/triggers/alert-triggers#configure-the-alert-rule) for more information. ## Run the workflow After you attach the workflow to detection rules, it runs automatically when those rules generate alerts. You can also [run it on demand](/elastic/docs-content/pull/7815/explore-analyze/workflows/authoring-techniques/manage-workflows#workflow-run) from the **Workflows** page. ## Where results appear After the workflow runs, look in these places for the classification output and execution details: | Result | Where to look | |---------------------------------|---------------------------------------------------------------------------------------------------------| | Started, verdict, or error note | **Alerts** → alert details → **Notes**. If a conversation was created, the verdict note links to it. | | Workflow tags | Alert tags (`kibana.alert.workflow_tags`) on the alert, for example in the alert details **Table** tab. | | Auto-close | Alert status and close reason, when the verdict is a false positive within your confidence range. | | Execution history | **Workflows** → open the workflow → **Executions**. | ## Related pages - [View detection alert details](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7815/solutions/security/detect-and-alert/view-detection-alert-details): Find notes, tags, and other alert fields after a run. - [Triage alerts with an AI agent](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7815/explore-analyze/workflows/use-cases/security/automate-security-operations/ai-driven-alert-triage): Build your own AI triage workflow.