--- title: Configure Watches and Workers description: Learn what each AlertZero Watch and Worker does in Elastic Security, turn Workers on or off, and decide what needs your approval. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings products: - Elastic Cloud Serverless - Elastic Documentation - Elastic Security applies_to: - Serverless Security projects: Preview - Elastic Stack: Planned --- # Configure Watches and Workers AlertZero groups its Workers by area of expertise into the [Triage Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/triage-watch), [Detection Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/detection-watch), [Hunt Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/hunt-watch), and [Forensics Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/forensics-watch). From each Watch's page, you can turn its Workers on or off and change their settings. ## Workers at a glance Use the following table to find each Worker's Watch, how often it runs by default, and where on the **Proposed actions** page you review its work. | Worker | Watch | Runs by default | Proposed actions section | |-----------------------------------------------------------------------------------------------------------------------------------------------------|-----------------|------------------|--------------------------| | [Alert Triage](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/alert-triage-worker) | Triage Watch | Every 15 minutes | Investigate | | [Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker) | Triage Watch | Every 24 hours | Investigate | | [Rule Tuning](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-tuning-worker) | Detection Watch | Every 2 hours | Configure | | [Rule Coverage](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-coverage-worker) | Detection Watch | Every hour | Configure | ## How Workers depend on each other Some Workers depend on another Worker's results. If you turn off the Worker they depend on, they stay on, but they get less to work on, or nothing: - If you turn off Continuous Threat Hunt, Rule Coverage gets no new detection gaps to propose rules for. - If you turn off Attack Discovery, Endpoint Analysis gets no attacks to investigate. - If you turn off Alert Triage, false positives stay open until someone closes them. Attack Discovery analyzes them along with your other open alerts, and Rule Tuning counts only the false positives that people close. These Workers also need [Context Engine](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/explore-analyze/ai-features/context-engine) to pass results to each other. For what happens without it and what else AlertZero needs to run, refer to [Set up AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/set-up-alertzero). ## What you approve for Workers To control which steps wait for your approval, set each Worker's **Autonomy** level. Every Worker starts at **Manual**, where you approve every action it proposes. Some Workers also ask you before they start analyzing. Each Worker offers at most one other level, where you approve less: - **Assisted**: The Worker starts its analysis without asking you, but it still waits for you before it makes any change. - **Supervised**: The Worker approves its own proposed actions, and you review the results afterward. The following table shows what you approve for each Worker at each level it offers. | Worker | Manual | Assisted | Supervised | |-----------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|----------------------------------------|------------------------------------------------------------------------------------------| | [Alert Triage](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/alert-triage-worker) | Each closure it proposes | Not offered | Nothing. It closes false positives on its own, and you can reopen any you disagree with. | | [Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker) | Each attack before it goes to the Forensics Watch. It closes false-positive attacks on its own. | Not offered | Nothing. It hands attacks off on its own. | | [Rule Tuning](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-tuning-worker) | Each rule before the Worker analyzes it, and each change before it reaches the rule | Each change before it reaches the rule | Not offered | | [Rule Coverage](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-coverage-worker) | Each gap before the Worker drafts a rule, and each rule before it takes effect | Each rule before it takes effect | Not offered | ## Change Worker settings To change a Worker's settings, you need **All** for **AlertZero** and the `manage_security` cluster privilege. To turn Workers on or off, you also need the **Workflows** sub-feature privileges **Update** and **Update managed workflows**. Because `manage_security` also lets anyone who has it manage users and roles for the whole cluster, ask an administrator who already has it to make the change instead of granting it only for AlertZero. To learn more, refer to [AlertZero privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/alertzero-privileges). 1. Find **Watches** in the navigation menu or use the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/explore-analyze/find-and-organize/find-apps-and-objects). 2. Select the Watch that the Worker belongs to, such as **Triage Watch**. 3. Find the Worker. On a Watch with more than one Worker, expand the Worker's section. 4. Make your changes: - To turn the Worker on or off, use the **Enabled** switch. Before you turn it off, check [which Workers depend on it](#alertzero-worker-on-off). - To change what needs your approval, select an **Autonomy** level. Refer to [what you approve at each level](#alertzero-worker-autonomy). - To change how often it runs or its other settings, refer to the Worker's page. 5. Select **Save**. To undo your changes instead, select **Discard**.