Configure Watches and Workers
AlertZero groups its Workers by area of expertise into the Triage Watch, Detection Watch, Hunt Watch, and Forensics Watch. From each Watch's page, you can turn its Workers on or off and change their settings.
Use the following table to find each Worker's Watch, how often it runs by default, and where on the Proposed actions page you review its work.
| Worker | Watch | Runs by default | Proposed actions section |
|---|---|---|---|
| Alert Triage | Triage Watch | Every 15 minutes | Investigate |
| Attack Discovery | Triage Watch | Every 24 hours | Investigate |
| Rule Tuning | Detection Watch | Every 2 hours | Configure |
| Rule Coverage | Detection Watch | Every hour | Configure |
Some Workers depend on another Worker's results. If you turn off the Worker they depend on, they stay on, but they get less to work on, or nothing:
- If you turn off Continuous Threat Hunt, Rule Coverage gets no new detection gaps to propose rules for.
- If you turn off Attack Discovery, Endpoint Analysis gets no attacks to investigate.
- If you turn off Alert Triage, false positives stay open until someone closes them. Attack Discovery analyzes them along with your other open alerts, and Rule Tuning counts only the false positives that people close.
These Workers also need Context Engine to pass results to each other. For what happens without it and what else AlertZero needs to run, refer to Set up AlertZero.
To control which steps wait for your approval, set each Worker's Autonomy level. Every Worker starts at Manual, where you approve every action it proposes. Some Workers also ask you before they start analyzing. Each Worker offers at most one other level, where you approve less:
- Assisted: The Worker starts its analysis without asking you, but it still waits for you before it makes any change.
- Supervised: The Worker approves its own proposed actions, and you review the results afterward.
The following table shows what you approve for each Worker at each level it offers.
| Worker | Manual | Assisted | Supervised |
|---|---|---|---|
| Alert Triage | Each closure it proposes | Not offered | Nothing. It closes false positives on its own, and you can reopen any you disagree with. |
| Attack Discovery | Each attack before it goes to the Forensics Watch. It closes false-positive attacks on its own. | Not offered | Nothing. It hands attacks off on its own. |
| Rule Tuning | Each rule before the Worker analyzes it, and each change before it reaches the rule | Each change before it reaches the rule | Not offered |
| Rule Coverage | Each gap before the Worker drafts a rule, and each rule before it takes effect | Each rule before it takes effect | Not offered |
To change a Worker's settings, you need All for AlertZero and the manage_security cluster privilege. To turn Workers on or off, you also need the Workflows sub-feature privileges Update and Update managed workflows. Because manage_security also lets anyone who has it manage users and roles for the whole cluster, ask an administrator who already has it to make the change instead of granting it only for AlertZero. To learn more, refer to AlertZero privileges.
Find Watches in the navigation menu or use the global search field.
Select the Watch that the Worker belongs to, such as Triage Watch.
Find the Worker. On a Watch with more than one Worker, expand the Worker's section.
Make your changes:
- To turn the Worker on or off, use the Enabled switch. Before you turn it off, check which Workers depend on it.
- To change what needs your approval, select an Autonomy level. Refer to what you approve at each level.
- To change how often it runs or its other settings, refer to the Worker's page.
Select Save. To undo your changes instead, select Discard.